South Korean cryptocurrency exchange Coinone disclosed a significant data breach on November 15, 2026, after attackers infiltrated MetaM, its outsourced customer support provider. The intrusion potentially exposed passwords, banking information, national identification numbers, and cryptocurrency wallet details belonging to customers.
According to Coinone's disclosure, unauthorized access to MetaM's servers occurred around 4 a.m. Korean Standard Time on November 12. The contractor notified Coinone at approximately 9:20 a.m. that morning, with the exchange publicly disclosing the incident three days later.
Scope of Exposed Information
The potentially compromised customer data encompasses 11 categories: telephone numbers, names, email addresses, dates of birth, bank account numbers, passwords, resident registration numbers, identification document issuance dates, residential addresses, cryptocurrency wallet addresses, and transaction identifiers.
Not every customer necessarily had all 11 categories exposed. The compromised records concern information voluntarily supplied during previous customer support interactions, meaning customers who never contacted Coinone's support center fall outside the incident's identified scope.
Coinone has not disclosed how many individuals were affected or precisely how much information attackers obtained. The company intends to introduce a lookup service allowing customers to determine which personal details were involved.
Trading Infrastructure Unaffected
Coinone maintains that its principal trading infrastructure remained untouched. Customer accounts, transaction systems, and cryptocurrency wallets operate independently of MetaM's compromised servers.
The exchange stated that authentication procedures require additional verification through registered one-time passwords or Kakaotalk, while unauthorized login methods are blocked. Coinone explained that the exposed information is insufficient for third parties to log in to accounts or withdraw assets.
Following the discovery, Coinone blocked suspicious IP addresses, restricted access to compromised systems, strengthened transaction monitoring, and temporarily transferred customer support operations to email-only service. The exchange notified the Korea Internet & Security Agency, Personal Information Protection Commission, and Financial Supervisory Service.
Broader Industry Concerns
Coinone's breach joins several other notable cryptocurrency industry data breaches in 2026. In November, Gnosis Pay experienced unauthorized access involving its cryptocurrency debit card infrastructure. Chainalysis disclosed a separate security incident in late October, identifying exposed account credentials and authentication tokens. South Korean exchange Bithumb encountered unauthorized access to internal communications infrastructure in October, identifying records associated with 6,444 customers. Coinbase disclosed customer information exposure in September associated with third-party analytics provider Amplitude.
These incidents demonstrate that customer information can remain vulnerable even when cryptocurrency custody systems escape compromise. The broader concern extends beyond cryptocurrency theft: exchanges that successfully protect customer assets can expose users to lasting financial and identity risks through inadequately secured third-party relationships.
