SKN | Coinone Warns of Phishing and Identity Theft Following Customer Data Breach

Key Points

• South Korean cryptocurrency exchange Coinone warned customers of potential phishing and identity theft after an attacker accessed servers belonging to its outsourced customer support provider, MetaM.

• Potentially exposed information includes names, phone numbers, email addresses, passwords, bank account numbers, national identification numbers and cryptocurrency wallet addresses.

• Coinone said its trading, account and wallet infrastructure was not directly compromised and urged affected customers to take precautions against fraudulent activity.

Third-Party Security Breach Exposes Customer Support Records

South Korean cryptocurrency exchange Coinone has warned customers about potential phishing scams and identity theft following a security breach involving its outsourced customer support provider.

In a Sunday announcement, Coinone said an attacker accessed servers operated by MetaM on Thursday and viewed or extracted customer support records. The exchange said it became aware of the incident on the same day.

The potentially exposed information includes customers’ names, phone numbers, email addresses, dates of birth, bank account numbers, passwords, national identification numbers, residential addresses, cryptocurrency wallet addresses and transaction IDs.

Coinone emphasized that the information involved varies by customer. Individuals who had never contacted its customer support center were not affected, according to the exchange.

The company did not disclose the number of customers whose information may have been exposed.

Exchange Warns of Phishing and Identity Theft Risks

Coinone urged customers to remain alert for suspicious communications that could use information obtained from previous customer service interactions.

The exchange warned that fraudsters could impersonate Coinone representatives using personal details from earlier conversations to make phishing attempts appear legitimate.

Customers who shared passwords during support interactions were specifically advised to change them.

The potential exposure of financial and identity-related information increases the risk of targeted social engineering attempts. Criminals could use details such as bank account numbers, transaction IDs or wallet addresses to create convincing messages intended to obtain additional credentials or induce unauthorized transactions.

Coinone’s warning highlights the risks associated with third-party service providers that handle sensitive customer information, even when the primary financial platform maintains separate infrastructure.

Trading and Wallet Infrastructure Reportedly Unaffected

Coinone said its account, trading and cryptocurrency wallet infrastructure operates separately from MetaM’s servers. The exchange reported no evidence that these systems were directly compromised.

This distinction suggests that the incident involved customer support information rather than a confirmed breach of the exchange’s core trading or wallet systems.

Coinone also confirmed that it had reported the incident to South Korean authorities.

However, the absence of evidence of direct infrastructure compromise does not eliminate the potential risks associated with exposed customer information. Phishing attempts and identity theft can occur independently of unauthorized access to an exchange’s trading systems.

South Korea Strengthens Financial-Sector Cybersecurity Oversight

The incident comes as South Korean regulators increase scrutiny of cybersecurity practices across the financial sector.

In October, the Financial Services Commission identified security deficiencies at 130 of the 555 financial firms included in its review.

The regulator also announced on Thursday that cryptocurrency exchanges would be permitted to suspend withdrawals when hacking activity is suspected. The measure forms part of broader calls for continuous, round-the-clock monitoring of suspicious activity.

These developments reflect growing regulatory attention to the security of digital asset platforms and the protection of customer funds and personal information.

Third-Party Security Remains a Critical Risk

Coinone’s disclosure illustrates how vulnerabilities involving outsourced service providers can create risks for cryptocurrency customers, even when an exchange’s primary infrastructure remains unaffected.

The immediate focus will be on determining the extent of the exposed information, monitoring potential phishing attempts and strengthening safeguards around third-party access to customer records.

Customers will also be watching for further disclosures from Coinone and South Korean authorities as the investigation progresses. The incident reinforces the importance of data protection, vendor oversight and effective cybersecurity monitoring across the digital asset industry.