Coinone warned customers about phishing and identity theft on November 15, 2026, after an attacker accessed information held by its outsourced customer support provider, MetaM. The South Korean exchange said potentially exposed records include passwords, bank account numbers and identity details supplied during support conversations.
The scope depends on each customer's interactions. Coinone's notice lists information that may have been exposed across the affected records; it does not say every listed field was stolen from every customer. It also said investigators had found no signs of direct intrusion into its separate account, trading or cryptocurrency wallet systems.
Support conversations contained sensitive information
According to Coinone's disclosure, the affected material came from chat and telephone inquiries. Its list includes names, telephone numbers, email addresses, dates of birth, resident registration numbers, identity document issuance dates and home addresses. Wallet addresses and transaction identifiers also appear among the potentially exposed fields.
Coinone said it was preparing individual notifications or a lookup service so customers could determine which of their information was affected.
A customer's own support history can help guide their response. Someone who supplied a password during an inquiry faces a different immediate problem from someone whose conversation contained only contact information. Until individual notices arrive, recalling what they shared during past inquiries can help customers decide what to address first.
The reported inclusion of wallet addresses and transaction identifiers adds a crypto-specific concern. A conversation containing those details could give an impersonator a convincing reference point: a particular transfer the customer remembers discussing. A caller's familiarity with that transfer would therefore be a poor reason to trust a new request.
Coinone blocks access and changes support operations
The Herald Business reported that the attacker accessed MetaM's servers on November 12 and that the contractor notified Coinone that day. Coinone subsequently disclosed the incident on November 15.
After learning of the breach, the exchange switched its outsourced customer center to email support. It blocked attack-related IP addresses and access routes, increased monitoring for unusual logins and transactions, and began examining the contractor's security management.
The exchange also reported the incident to the Korea Internet & Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service. Investigators and outside specialists are examining the circumstances of the leak.
For customers, the exchange's containment measures address only part of the problem. Blocking the intrusion route addresses further access through that route, but information already copied can still give an impersonator material for a subsequent approach.
A convincing call could arrive after the technical containment work, using details from an old inquiry to make a fresh demand sound routine. Customers assessing such a call would need to consider what the caller asks them to do, even if the exchange has secured the compromised server.
A familiar conversation can become a phishing script
Coinone specifically warned that messages or calls referring to previous support conversations could be impersonation attempts. It told customers who had shared passwords during support interactions to change their Coinone passwords and replace matching passwords used elsewhere.
The exchange said it does not ask by phone, text or email for passwords, one-time passwords or verification codes. It also said it does not request cryptocurrency withdrawals or wallet address changes through those channels.
Those instructions give customers a concrete test for an incoming approach. Knowledge of an earlier complaint does not authorize the caller to request a code or redirect a withdrawal. Accurate background details offer no reason to make an exception to Coinone's stated practices.
The UK's National Cyber Security Centre gives similar general guidance for people affected by data breaches. Criminals may impersonate the breached organization and claim that customers must verify an account because fraudulent activity has occurred. Messages can direct recipients to imitation websites that capture the information they enter.
Its advice is to contact the organization through its official website or established channels, avoiding contact details supplied in an unexpected message. Customers should also check accounts for unfamiliar activity, including changed security settings, unusual login attempts or messages they did not send.
Applied here, that means opening Coinone through an independently accessed channel before responding to a claimed security problem. A message promising to help identify exposed records should receive the same scrutiny as a withdrawal request. The breach itself supplies a plausible pretext for contact.
Overview
Coinone's disclosure concerns customer support information stored by MetaM, with the exposed fields varying according to what each customer supplied. The exchange reported no detected direct intrusion into its separate trading and wallet systems.
The immediate customer risk centers on impersonation using those support records. Coinone's specific instruction is to replace passwords shared during inquiries, including reused passwords on other websites.
