Coinone Alerts Customers to Phishing, Identity Theft After Breach

South Korean crypto exchange Coinone has issued a security warning to customers after an attacker breached the servers of its outsourced customer support provider, MetaM. The incident reportedly involved access to records handled during customer service interactions, prompting concerns about phishing and identity theft.

In a notice released Sunday, Coinone said it discovered the intrusion on the same day the breach occurred, after learning that an attacker accessed systems operated by MetaM on Thursday. Coinone also stated that it has informed South Korean authorities and emphasized that it has not found evidence suggesting its own trading or wallet infrastructure was directly compromised.

Key takeaways

• Coinone attributes a potential data exposure to a breach of MetaM, its outsourced customer support provider.
• Coinone says exposed information could include personal details and sensitive account data shared during support interactions.
• The exchange warned customers about password compromise and fraudsters impersonating Coinone using prior conversation details.
• Coinone reported the matter to South Korean authorities and said its core systems remain separate from MetaM’s servers.
• The disclosure arrives as regulators push stronger cybersecurity oversight for financial firms, including crypto exchanges.

What Coinone says was accessed

Coinone’s notice states that the attacker accessed servers operated by MetaM and viewed or extracted information tied to customer support activities. The exchange did not disclose the number of affected customers, and it indicated that exposure would vary depending on what each user provided or discussed with support.

According to Coinone, the information potentially exposed includes a wide range of identifiers and account-related details. The list reportedly includes names, phone numbers, email addresses, dates of birth, bank account numbers, passwords, national identification numbers, home and wallet addresses, and transaction IDs.

Coinone added that customers who never contacted its support center were not affected. The practical implication for users is that the risk is not uniform: those who used support services—especially if they provided credentials—face the highest likelihood of downstream harm.

Why the warning focuses on impersonation and password changes

Coinone urged customers to review their security posture, particularly those who may have shared passwords during customer support interactions. The exchange specifically recommended that affected users change any passwords that were provided or used in prior support conversations.

The notice also warned that scammers could use details from earlier exchanges to impersonate Coinone and deceive customers into revealing additional information. This is a common tactic in incidents involving support-channel data: fraudsters do not need to compromise a blockchain or trading system directly—if they can make their messages appear credible, they can often trick users into taking unsafe actions.

For traders and holders, this means the immediate threat may show up not in on-chain activity, but in targeted communications such as emails, message requests, or fake account recovery prompts that reference “support” topics users may recognize from past interactions.

What wasn’t compromised, according to Coinone

Coinone stressed that its operational setup differs from MetaM’s. The exchange said its account, trading, and wallet infrastructure operates separately from MetaM’s servers and that it has found no evidence indicating a direct compromise of those core systems.

That distinction matters for customers because it suggests the incident is primarily a data exposure risk rather than an immediate threat to custody or trading continuity—though it does not eliminate the risk that stolen credentials could be used elsewhere if users reused passwords.

Coinone also said it has reported the incident to South Korean authorities, aligning with expectations that financial entities notify regulators when breaches potentially involve sensitive information.

Broader regulatory pressure on cybersecurity in South Korea

The Coinone warning comes amid heightened regulatory focus on cybersecurity across South Korea’s financial sector. In October, the Financial Services Commission (FSC) reportedly identified security deficiencies at 130 of 555 financial firms reviewed.

Crypto exchanges, in particular, have been under closer scrutiny. According to earlier reporting, the FSC said it would allow exchanges to suspend withdrawals when hacking is suspected, alongside calls for continuous monitoring. This policy direction reflects a growing emphasis on operational resilience—reducing the time attackers have to move funds and strengthening detection and response capabilities.

Coinone’s notice illustrates how that regulatory push intersects with real-world incident patterns: breaches in vendor or outsourced support functions can still create material risk for users, even when the exchange’s own systems are not directly compromised.

What customers should watch next

Customers should monitor for suspicious messages that reference prior support contact, change any passwords that may have been disclosed to support, and verify account recovery requests through official Coinone channels. Until the exchange provides further details on the scope and timeline of the MetaM incident, the main uncertainties remain how many users were affected and what specific data fields were actually extracted.