South Korean crypto exchange Coinone is warning customers about phishing and identity theft after an attacker breached servers run by MetaM, the outside firm that handles its customer support.
Coinone said its own systems held firm, but records stored by the contractor may have been viewed or extracted. The exchange disclosed the incident publicly on Sunday, November 15, three days after the intrusion, which it said took place on Thursday, November 12, 2026, at around 4 a.m. local time.
What happened at MetaM
According to Coinone, the attacker reached servers operated by MetaM and viewed or extracted customer support records stored there. The exchange said only users who had interacted with customer support, and therefore had records on MetaM's systems, were affected.
Coinone also stressed that its core infrastructure was not directly compromised. That includes member accounts, the trading platform and the crypto wallet systems that hold customer funds.
Data potentially exposed
Coinone said the potentially exposed information includes:
- Names, phone numbers, email addresses and dates of birth
- Bank account numbers, passwords, resident registration numbers and home addresses
- Crypto wallet addresses and transaction IDs
The exchange warned that the leaked data could be used for phishing and identity theft.
Coinone's response
Coinone has switched its customer support to email only while it deals with the fallout. The company also reported the incident to multiple Korean regulators, including the Korea Internet & Security Agency and the Financial Supervisory Service.
With personal and financial details potentially in an attacker's hands, Coinone flagged a heightened risk of phishing scams and identity theft.
What users should watch
For affected customers, the immediate risk highlighted by the incident is social engineering rather than a drained account. Scammers armed with leaked support records could impersonate the exchange, a bank or a government agency.
Because passwords were on the list of potentially exposed data, changing them, especially any reused across services, is a sensible step.
What to watch next includes whether Coinone publishes a count of affected users, what the Korea Internet & Security Agency and the Financial Supervisory Service conclude, and whether any phishing campaigns tied to the leaked records surface in the coming weeks.
