Coinone data breach: support data with passwords exposed - CryptoTicker.io

The breach occurred on November 12, 2026, when attackers accessed MetaM's servers at approximately 4 a.m. Korean time (8 p.m. CET on November 11). MetaM reported the incident to Coinone at 9:20 a.m. Korean time the same day, though the exchange only made the attack public three days later. The affected server contained customer service records including chat transcripts and phone call notes.

Coinone has not yet disclosed how many customers are affected, though the scope includes anyone who has ever contacted support. The exchange is investigating the incident with MetaM and Korean authorities, including the Korea Internet & Security Agency (KISA), the data protection commission PIPC, and the financial supervisor FSS.

Sensitive Data Exposed

Eleven types of data may have been compromised, depending on what customers shared in support conversations. These include name, phone number, email address, date of birth, home address, bank account numbers, passwords mentioned in chats, Korean resident registration numbers, wallet addresses, and transaction IDs (TXIDs).

Particularly concerning are passwords that customers may have shared during support conversations. Coinone advises anyone who has ever shared a password with support to change it immediately, not just on their platform but on any other service where the same password is used.

The leaked details alone would not let anyone log into someone else's account or withdraw funds.

Security Measures

Coinone stresses that its core systems—member accounts, trading platforms, and wallet systems—run separately from MetaM's servers and show no signs of intrusion. The exchange emphasizes that all logins require two-factor authentication (2FA), which would prevent unauthorized access even if passwords were compromised.

Immediate actions taken by Coinone include blocking the IP addresses used in the attack, switching customer service to email-only inquiries, and implementing tighter real-time monitoring of suspicious logins and transactions. The exchange plans to notify affected customers individually and establish a lookup tool for customers to check if their data was compromised.

Outsourced Support Risks

The incident highlights a growing vulnerability in the crypto industry: exchanges frequently outsource customer service, creating secondary storage locations for sensitive data that may have weaker security than core systems. Support transcripts contain detailed conversation histories that can be used for highly convincing spear phishing attacks.

Fraudsters can use leaked support data to impersonate legitimate customer service representatives, referencing specific past conversations to gain victims' trust. This approach, known as spear phishing, is particularly effective when attackers know details about a customer's previous issues with deposits, withdrawals, or account access.

Coinone warns customers to be vigilant against potential phishing attempts and recommends changing passwords, using authenticator apps for 2FA instead of text messages, and never sharing 2FA codes or recovery phrases with anyone claiming to be support staff.