Coinone Warns Users of Phishing and Identity Theft After Breach

South Korean crypto exchange Coinone has warned users to stay alert for phishing and identity-theft attempts after an attacker breached servers operated by its outsourced customer support provider. The exchange says the incident exposed records created during customer service interactions, potentially including sensitive account information.

In a notice published Sunday, Coinone said it learned that the breach occurred on Thursday, when an attacker accessed systems run by MetaM and viewed or extracted customer support data. Coinone has not disclosed how many customers were affected, and it emphasized that the impact varies by individual based on what information the user shared during support requests.

Key takeaways

• Coinone attributes the breach to servers operated by its outsourced support provider, MetaM, rather than its own trading or wallet infrastructure.
• The exchange says exposed data could include identifiers and credentials shared during customer service, with the specific records differing by customer.
• Coinone urges users who provided passwords to change them and warned that scammers may impersonate the exchange using details from past interactions.
• Coinone reports it has notified South Korean authorities and says there is no evidence of direct compromise of its core systems.
• The incident aligns with broader South Korea efforts to tighten cybersecurity requirements across financial-sector firms, including crypto exchanges.

What Coinone says was exposed

According to Coinone, the potentially exposed information includes a broad set of personal and account-related data such as names, phone numbers, email addresses, dates of birth, bank account numbers, passwords, national identification numbers, home and wallet addresses, and transaction IDs.

The exchange stressed that not every user would be impacted. Coinone said customers who never contacted its support center should not be affected by the incident, because the exposed records are tied to customer service interactions.

Coinone did not provide an estimate of the number of affected individuals, but it made clear that the risk profile depends on whether a given account had interactions with the support center and what the user submitted during those conversations.

Why outsourced support breaches matter

The event highlights a common weak spot in digital security: even when an exchange’s operational systems remain intact, attackers may still obtain valuable data through third-party service providers. Coinone’s notice indicates the attacker accessed MetaM-operated servers used for customer support, where sensitive user information can be stored to manage account and service issues.

For users, this type of breach can be more than a privacy incident. Coinone warned that fraudsters could impersonate the exchange using information drawn from previous conversations, increasing the likelihood of convincing phishing campaigns or social-engineering attempts.

That risk is particularly acute when support chats or ticketing workflows include credentials or highly specific personal details. Coinone specifically called out cases where passwords may have been shared during customer assistance, which raises the potential for account takeover if those credentials are reused elsewhere.

Coinone’s response and assessment

Coinone said it has no evidence that its account, trading, or wallet infrastructure was directly compromised, adding that those systems operate separately from MetaM’s servers. The exchange also said it reported the incident to South Korean authorities.

The distinction is important for how users evaluate the threat. If only support records were accessed, the immediate risk may be centered on identity theft, targeted scams, and the misuse of personal data—though the inclusion of passwords in Coinone’s description means users should treat the incident as potentially relevant to account security as well.

Coinone’s practical guidance to customers focuses on prevention: it urged users to change any passwords they shared during support interactions and reiterated that scammers may attempt to use prior contact details to appear legitimate.

Regulatory pressure on cybersecurity in South Korea

Coinone’s disclosure arrives as South Korea continues to push for stronger cybersecurity controls across the financial sector. In October, the Financial Services Commission (FSC) identified security deficiencies across 130 of 555 financial firms it reviewed, according to coverage cited by Cointelegraph.

More directly for crypto markets, Cointelegraph previously reported that the FSC said it would allow crypto exchanges to suspend withdrawals when hacking is suspected, alongside calls for continuous monitoring. Those moves are aimed at reducing the window between an attack and protective action—an approach that complements, but does not replace, protections for identity and customer-service systems.

Taken together, the picture for investors and customers is that regulators are increasing attention on both operational resilience and incident response. While the MetaM breach may not imply immediate trading or custody compromise, it reinforces how attackers can target the customer touchpoints that sustain trust and account access.

What users should watch next

Coinone has not said how many customers were affected or provided additional technical details about what was extracted, so the next key step will be whether further information emerges from the investigation and any follow-up guidance from the exchange. Users should remain alert for impersonation attempts and review account security—especially if they ever shared credentials during support interactions—while watching for official updates from Coinone and South Korean regulators.