South Korean crypto exchange Coinone says a hacker broke into the servers of MetaM, the outside firm that runs its customer support, and viewed or took records of support chats and calls. Depending on what each customer said to an agent, the exposed details can include resident registration numbers, bank account numbers and even account passwords. Coinone says its own account, trading and wallet systems were not breached, but it is warning customers to expect phishing calls built on the leaked conversations.
What Coinone disclosed
In a notice dated Nov. 15, Coinone said an external attacker illegally accessed the servers of MetaM Co., the contractor that handles its customer consultations, at around 19:00 UTC on Nov. 11. MetaM reported the intrusion to Coinone roughly five hours later. Coinone apologized and said it took responsibility as the company that handed the work out.
The notice lists 11 types of data that may have leaked, all of it information customers gave during chat or phone support: the phone number used for the consultation, name, email address, date of birth, bank account number, password, resident registration number, ID card issue date, home address, crypto wallet address and transaction ID. Coinone stressed that this lists everything that could have been exposed, and the actual items differ from person to person. Customers who never contacted the support center are not affected, it said.
The exchange did not say how many people were affected. It also did not say whether passwords typed or spoken to support staff were stored in encrypted form, a gap flagged by the Korean outlet Noksaek Gyeongje Sinmun. Coinone said it is preparing a lookup service so customers can check which of their own details were involved.
Why Coinone says accounts are still safe
Coinone’s argument rests on separation and two-factor login. Member accounts, trading and crypto wallets run on systems kept apart from MetaM’s servers, and there is no sign so far that those were entered directly, the exchange said. Every login also requires a second step, either an OTP or KakaoTalk verification on a phone registered in the customer’s own name, and login requests that do not come from the official app are blocked automatically. On that basis, Coinone said, the leaked information alone cannot be used to log in to an account or withdraw assets.
The bigger risk is social engineering: an attacker who knows what a customer discussed with support can pose convincingly as Coinone staff. The exchange told customers that it never asks for passwords, OTP codes or verification numbers by phone, text or email, and never asks users to withdraw crypto or change a withdrawal address. Anyone who shared a password with an agent should change it on Coinone and on any other site where it was reused, the notice said.
Coinone said it blocked the IP addresses used in the attack and access to the support center, moved its outsourced support desk to email only, and stepped up real-time monitoring for unusual logins and trades. It has reported the breach to the Korea Internet and Security Agency (KISA), the Personal Information Protection Commission and the Financial Supervisory Service, and is checking MetaM’s security directly.
A vendor with many clients
MetaM published its own notice a day earlier. According to Yonhap, the firm said it first noticed something wrong when a customer support service went down about two hours after the time Coinone gives for the intrusion, and later confirmed that phone numbers and consultation conversations had been viewed or taken out of some of its systems. It reported the incident to KISA the following day, isolated affected servers and changed administrator passwords. MetaM said the scope varies by client and that not every user’s data was leaked.
That leaves open who else is exposed. MetaM lists brokerages NH Investment & Securities and Kiwoom Securities, OK Savings Bank and a range of telecom, gaming and retail companies among its clients, Noksaek Gyeongje Sinmun reported, but none of them has confirmed being affected and MetaM has not published a list of affected clients. So far, Coinone is the only one to say publicly that its customers’ data was involved.
The 72-hour clock and a string of Korean breaches
South Korea’s Personal Information Protection Act enforcement decree requires companies to notify affected people within 72 hours of learning of a leak. Coinone’s notice went up about 71 hours after the time it says MetaM informed it.
Coinone’s breach is the latest in a run of Korean exchange incidents. According to Yonhap, an intrusion through Bithumb’s internal groupware late last month exposed the names, phone numbers, resident registration numbers and ID copies of 844 customers. GOPAX suspended withdrawals and trading on Nov. 6 after receiving a hacking threat, and regulators have since moved to let exchanges freeze withdrawals when a hack is only suspected. The Financial Supervisory Service has called the security chiefs of every virtual asset service provider to a Nov. 19 meeting on hacking response, Yonhap reported. Coinone’s case puts a less obvious weak point on that agenda: the contractors that hold customer data outside an exchange’s own walls.
FAQ
Were Coinone customers’ crypto funds stolen?
Coinone says no. It says its account, trading and wallet systems are separate from MetaM’s servers and show no sign of direct intrusion, and that two-factor login stops the leaked data alone from being used to access accounts.
Who is affected by the Coinone data breach?
Only customers who contacted Coinone’s support center by chat or phone. What was exposed depends on what each person shared, and Coinone plans a lookup service so users can check their own records.
What should Coinone users do now?
Change any password that was shared with support staff, including on other sites that use it, and treat any call or message that refers to past support conversations as a possible scam.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
