South Korean crypto exchange Coinone confirmed a data breach at its outsourced customer service provider on Sunday, November 15, 2026. Attackers broke into the servers of MetaM, the company t
South Korean crypto exchange Coinone confirmed a data breach at its outsourced customer service provider on Sunday, November 15, 2026. Attackers broke into the servers of MetaM, the company that handles Coinone's chat and phone enquiries. Any customer who has ever contacted support may be affected, and depending on the conversation the data include passwords, bank account numbers and the Korean resident registration number. The exchange itself says it has seen no sign that accounts, trading or wallets were attacked.
For investors in Europe, Coinone is not a common trading venue. The case is instructive nonetheless, because it shows a pattern that also affects European exchanges: the target is neither the blockchain nor the exchange itself, but a service provider where conversation logs with sensitive details pile up over years. Those logs then become the raw material for especially convincing scams.
According to Coinone, as reported by the daily Hankook Ilbo and the business paper Financial News among others, an external attacker accessed a MetaM server at around 4 a.m. Korean time on November 12. That corresponds to 8 p.m. CET on the evening of November 11. At 9:20 a.m. Korean time the provider reported the incident to Coinone. The exchange only made the attack public three days later, in a notice on November 15.
The affected server held customer service records, meaning chat transcripts and notes on phone calls. Coinone has not yet said how many customers are affected. The exchange writes that the scope and exact sequence of events are being investigated together with the provider and the relevant authorities, and that it will publish new findings promptly.
According to the Korean reports, Coinone notified three authorities: the Korea Internet & Security Agency (KISA), the data protection commission PIPC and the financial supervisor FSS. As immediate measures, the exchange cites blocking the IP addresses used in the attack, switching customer service to email-only enquiries and tighter real-time monitoring of suspicious logins and transactions.
Coinone lists eleven types of data that may have come up in conversations. Which of them were actually stored on the server for any given person depends on what that person told support. The list, according to the Korean reports:
The transaction ID, or TXID, is the unique identifier of a transfer on the blockchain. Anyone who knows it can look up the amount, time and addresses involved in a block explorer. Combined with a name and address, a seemingly anonymous wallet address thus becomes a profile: who moved which coins when, and where that person lives.
The passwords are particularly sensitive. That customers mention them in a support chat at all is a well-known problem. Many send their password along when they have trouble logging in, even though no reputable provider asks for it. Coinone therefore advises anyone who has ever shared a password in a conversation to change it, including on any other service where the same password is used.
Support transcripts can be turned into messages that refer to a real earlier conversation.
Coinone stresses that member accounts, trading and the wallet systems run separately from the provider's servers. So far there are no signs of a direct intrusion into these systems. According to Financial News, the exchange also points out that every login requires two-factor authentication. The leaked details alone would not let anyone log into someone else's account or withdraw funds.
Two-factor authentication (2FA) means a second proof is needed besides the password, usually a one-time code from an app or by text message. This hurdle protects the account as long as the second factor does not also fall into the wrong hands. That is exactly what many scams after a data breach target: a caller poses as support, knows details from earlier conversations and asks for the code just received.
Coinone says it will notify affected customers separately and set up a lookup through which customers can check whether their data are affected. No date has been set yet. According to Financial News, the exchange also notes that those affected can claim damages under Korean law.
Crypto exchanges frequently outsource customer service, because the volume of enquiries swings sharply in market phases like the current one. The provider needs access to customer data for this, or it cannot answer questions about deposits and withdrawals. This creates a second location outside the exchange where personal details accumulate, often with less protection than in the core system.
The best-known case involved the US exchange Coinbase. In May 2025 it told the Securities and Exchange Commission that criminals had bribed staff at an overseas support team to copy customer data. Coinbase estimated the cost of the incident at $180 million to $400 million at the time, The Block reported from the mandatory filing. In autumn 2026 there was another incident at a Coinbase provider, this time at analytics firm Amplitude; the details are in our report on the Amplitude data breach.
The Coinone case is different: based on what is known so far, the attackers came in from outside via the servers, and bribed employees play no part. For customers, however, the result is similar. Anyone who knows the conversation history can convincingly pose as customer service. Cointelegraph quotes Coinone as warning that fraudsters could impersonate the exchange using details from earlier support conversations.
A stolen list of names and email addresses is enough for mass phishing. A chat log delivers more: the specific problem, the time, the name of the agent and often a ticket number. A fraudster can then write that they are getting in touch "about your withdrawal request from March" and immediately seem familiar. Such messages are called spear phishing: targeted deception tailored to a single person.
What happened: on November 12, 2026, unknown parties accessed the servers of MetaM, the customer service provider of Korean exchange Coinone. Depending on the conversation, names, contact and bank details, passwords, ID numbers, wallet addresses and transaction IDs may be affected. The number of people affected is unknown (as of November 15, 2026, 1 p.m. CET, according to Cointelegraph and Korean media).
Are you affected? Only people who hold a Coinone account and have at some point spoken to customer service by chat or phone can be affected. According to Coinone, anyone who never contacted support is not affected. Customers of European exchanges are not covered by this incident, but the steps below apply after any customer service data breach.
Our guide on how to store crypto safely explains the basics of secure storage, and the hardware wallet comparison compares suitable devices.
The attack hit a server outside the exchange where conversation logs had accumulated.
Coinone is not the only Korean trading venue that has had to report attacks in recent weeks. Hankook Ilbo and Financial News cite several incidents in their reports. At Bithumb, according to Hankook Ilbo the country's second-largest exchange, an internal office system was attacked on October 27. Data on 715 employees and on customers were leaked; the two papers give different figures for the number of customers, with Hankook Ilbo citing 6,444 and Financial News 844.
According to Financial News, the exchange Gopax has reported unauthorised access to individual user accounts since September and was hit by extortion on November 6, after which it temporarily suspended deposits, withdrawals and trading. Cointelegraph also reports that Korea's Financial Services Commission (FSC) plans to allow exchanges to halt withdrawals when a hack is suspected, and is calling for round-the-clock monitoring.
The cluster of cases shows that attackers are deliberately looking for weaker points around the exchanges. The core systems holding customer funds are usually well secured. Office software, service providers and individual customer accounts offer a larger attack surface.
For providers in the EU, fixed rules apply in an incident like this. Under Article 33 of the General Data Protection Regulation (GDPR), a company must report a data breach to the competent supervisory authority within 72 hours of becoming aware of it. If there is a high risk to those affected, for example because passwords or account numbers have leaked, Article 34 requires the customers themselves to be notified without undue delay. The exchange remains responsible for its provider, because it is liable for the processors it has commissioned.
Exchanges authorised under the European crypto regulation MiCA must also demonstrate that they have their IT risks under control, including for outsourced tasks. Which providers hold such a licence is shown in our comparison of regulated crypto exchanges with MiCA authorisation. What the licence requires in detail is set out in our overview of the MiCA obligations for crypto companies.
If a breach occurs, those affected are also entitled to compensation under Article 82 GDPR. How much that can amount to, and what Germany's Federal Court of Justice has ruled on it, is covered in our article on claiming compensation after a data breach at crypto services.
The Coinone case shows that a conversation log can become a risk years later. Whatever is written in a chat sits with the provider or its contractor and cannot be retrieved by the customer. Simple rules therefore apply when dealing with support at any exchange.
A password never belongs in the chat, not even when you have trouble logging in; support resets access through a separate process. The same applies to 2FA codes and, even more so, to a wallet's recovery phrase. Upload ID documents only in the app's designated verification area, never as a photo in the chat. For a query about a deposit, the amount, date and transaction ID are usually enough; support does not need your full wallet history.
It also helps to note down which channel an exchange actually uses to contact you. Many providers only ever write via the in-app inbox. If a message arrives by text or messenger, that alone is a warning sign. Such a check takes two minutes and prevents many scam attempts, especially in weeks of steeply falling prices when investors want to act quickly.
It is still unclear how many Coinone customers are affected and who is behind the attack. Once the announced lookup goes live, customers will know whether their data were on the MetaM server. For everyone else, the case is a reason to review their own security. Three steps are enough to start:
(As of November 15, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
