Coinone warns of phishing, identity theft after data breach

South Korean crypto exchange Coinone is telling customers to watch their inboxes and phones closely. An attacker broke into the servers of MetaM, the outside firm that handles Coinone’s customer support, and may have walked off with the details people shared while asking for help.

The exchange says its own systems held firm. But the data that may have leaked is the raw material for phishing and identity theft.

What happened at MetaM

According to Coinone, the intrusion took place on Thursday, November 12, 2026, at around 4 a.m. local time. The exchange disclosed it publicly on Sunday, November 15, three days later.

The attacker reached servers run by MetaM, Coinone’s outsourced customer support contractor. Coinone said the intruder viewed or extracted customer support records stored there.

The list of potentially exposed information is long. It includes names, phone numbers, email addresses and dates of birth.

It also covers bank account numbers, passwords, resident registration numbers and home addresses. Crypto wallet addresses and transaction IDs are on the list too.

The scope does have a ceiling. Coinone said only users who had interacted with customer support, and therefore had records on MetaM’s systems, were affected.

The exchange also stressed that its core infrastructure was not directly compromised. That includes member accounts, the trading platform and the crypto wallet systems that actually hold customer funds.

Coinone’s response so far

Coinone has switched its customer support to email only. The move cuts off other channels while the exchange deals with the fallout.

The company also reported the incident to multiple Korean regulators. Those include the Korea Internet & Security Agency (KISA) and the Financial Supervisory Service.

The headline warning to users is about what comes next. With personal and financial details potentially in an attacker’s hands, Coinone flagged a heightened risk of phishing scams and identity theft.

Why the support desk is the weak spot

Exchanges spend heavily on securing hot wallets, cold storage and trading engines. The help desk is where customers hand over identity documents, account details and descriptions of their problems, often in plain text, to staff who may work for a separate company.

Outsourcing support is common across the industry because it scales cheaply. The tradeoff is that sensitive data ends up living on someone else’s servers, under someone else’s security practices.

The Coinone incident is a clean illustration of that tradeoff. The exchange’s wallets were reportedly untouched, yet customers still face real exposure because the contractor’s records held so much.

What this means for users and the market

For affected Coinone customers, the immediate risk is social engineering rather than a drained account. Scammers armed with leaked support records can impersonate the exchange, a bank or a government agency with unsettling accuracy.

Since passwords were on the list of potentially exposed data, changing them, especially any reused across services, is a sensible step.

Coinone has already brought KISA and the Financial Supervisory Service into the picture. What to watch next: whether Coinone publishes a count of affected users, what KISA and the Financial Supervisory Service conclude, and whether any phishing campaigns tied to the leaked records surface in the coming weeks.