Coinone Outsourced Support Hacked, Customer Data at Risk

Coinone Customer Service Systems Breached, Exposing User Data

South Korean cryptocurrency exchange Coinone confirmed on Sunday that its outsourced customer service operations were compromised by hackers, potentially exposing sensitive customer information including names, bank account details, and resident registration numbers.

The breach occurred around 4 a.m. on November 12th, when an external attacker illegally accessed the servers of MetaM (메타엠), the third-party vendor handling Coinone’s customer service. The compromised data includes consultation records that customers had previously provided during phone and online interactions. Coinone was alerted to the incident by MetaM at approximately 9:20 a.m. the same day.

According to a Coinone announcement on its official website, the types of data potentially leaked include phone numbers, names, email addresses, dates of birth, bank account numbers, passwords, resident registration numbers (South Korea’s national identification number), ID issuance dates, home addresses, wallet addresses, and transaction IDs (TXIDs) – a total of 11 categories.

Coinone emphasized that this list encompasses all potentially affected data types, and the actual extent of the leak will vary for each customer, as information provided during consultations differs.

Regarding the scale of the impact, Coinone stated that customers who have never contacted the customer service center are not affected by this incident. However, the exchange did not disclose the exact number of customers whose data may have been compromised. The company plans to offer a dedicated service for customers to check if their personal information was exposed.

In terms of asset security, Coinone assured users that its member account, trading, and virtual asset wallet systems operate independently from MetaM’s servers and have shown no signs of direct intrusion. The exchange highlighted that all logins require a second layer of verification, including a correct password and authentication via a customer’s registered OTP or KakaoTalk on their personal mobile phone. Login attempts from unofficial apps are automatically blocked, meaning the leaked data alone cannot be used to access accounts or withdraw assets.

In response to the breach, Coinone immediately suspended phone and real-time chat customer service operations with MetaM, reverting to an email-only support model. The company has also blocked the unauthorized access path and plans to conduct a comprehensive review of its own and its partners’ cybersecurity management systems. Coinone warned that malicious actors might use details from past consultations to impersonate the exchange and engage in fraudulent activities. Customers are urged to exercise caution and change any passwords previously provided during consultations if they receive suspicious calls, emails, or text messages.

A notable aspect of this incident is that the compromised system was not the exchange’s core financial infrastructure but rather a third-party customer service provider. This pattern has been observed repeatedly in the global crypto industry, where partner companies leak customer contact information, exposing users to phishing risks, while core exchange systems, protected by layers of isolation and multi-factor authentication, prove more difficult to breach directly. When exchanges outsource functions like customer service, marketing, or cloud operations, cybersecurity responsibilities do not necessarily transfer with the outsourcing. The security posture of a small partner vendor can directly determine the security baseline for an exchange’s customer data.

The timing of this incident is particularly sensitive. On the same day Coinone reported the customer service server breach (November 12th), the South Korean Financial Services Commission (FSC) convened a “Virtual Asset Industry Security Countermeasures Meeting.” The meeting acknowledged a recent spate of information leaks and security incidents within the industry and approved several new measures. These include requiring virtual asset service providers to establish 24/7 monitoring and response systems. Providers unable to maintain round-the-clock operations will be restricted to processing deposits and withdrawals only during their active monitoring hours, with prior notification to customers.

Another key decision allows for the pre-emptive freezing of deposits and withdrawals at the stage of “suspected hacking.” The FSC noted that current regulations under the Virtual Asset User Protection Act permit halting transactions only when a hack is definitively confirmed. Drawing parallels with cases like Binance, the FSC stated that earlier intervention can significantly reduce customer losses. Consequently, the FSC will issue “non-action opinions” to exchanges that proactively block transactions, thereby absolving them of legal liability for such preemptive measures. The meeting also mandated that exchanges maximize the proportion of customer assets held in cold wallets, with the regulatory minimum set at 80% (industry average already exceeds 95%). It also encouraged minimizing hot wallet balances, distributing them across multiple wallets, and increasing insurance coverage limits and reserve funds.

The FSC also highlighted the low membership rate of the Financial Security Institute among virtual asset providers, with only 5 out of 28 Korean Won market exchanges having joined. Future efforts will focus on encouraging the remaining providers to join, enabling them to access threat intelligence sharing, vulnerability assessments, and cybersecurity education at a level comparable to financial institutions. For those unable to join, assistance will be provided, similar to that offered to small and medium-sized financial institutions. Furthermore, the draft Digital Asset Act, currently under parliamentary review, will require digital asset providers to assume IT security obligations and liability for damages, mirroring the responsibilities of financial institutions.