Coinone Says a Hacked Support Vendor Exposed Resident Registration and Bank Account Numbers

Coinone published a notice at 08:00 KST on 15 November confirming that an intruder had reached a server belonging to MetaM, the contractor that runs its customer consultation service, and had viewed or exfiltrated the personal information customers leave during chat and phone support. The field list in that notice runs to eleven items. Resident registration numbers, bank account numbers and passwords are on it.

Coinone dates the intrusion to about 04:00 KST on 12 November. It says the contractor told it at about 09:20 that morning. The public notice followed 76 hours after the attack is said to have begun and 70 hours 40 minutes after the exchange knew. Nothing in the notice says when the company filed its reports with the Korea Internet and Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service, all three of which it names.

The exchange’s account, trading and wallet systems are operated separately from the contractor’s server, and Coinone says no direct intrusion into them has been confirmed. Customers who never opened a support ticket are outside the scope of the leak, the notice states.

What the MetaM Server Held

MetaM handles consultation for Coinone’s customer centre. A consultation record is not a know-your-customer file and not a trade record. It is whatever a customer typed into a chat window or read down a phone line while trying to recover an account, reverse a deposit or explain a failed withdrawal. The notice lists what those records contained.

“상담을 진행한 전화번호, 이름, 이메일, 생년월일, 계좌번호, 비밀번호, 주민등록번호, 신분증 발급일자, 자택주소, 지갑주소, TXID,” it reads: the phone number used in the consultation, name, email, date of birth, account number, password, resident registration number, ID document issue date, home address, wallet address and transaction ID.

Eleven fields. Coinone is explicit that this is the union of everything that could have been exposed rather than a per-customer list, because each consultation collected different details. Affected customers will be able to check which items apply to them through a lookup service the company says it is preparing.

The opening statement is direct about where responsibility sits. “당사는 고객님의 개인정보 보호를 위해 최우선으로 노력해 왔으나, 당사가 고객 상담 업무를 맡긴 수탁업체의 서버에 외부 공격자가 무단으로 침입하여 고객님의 소중한 개인정보가 유출되었음을 알려 드립니다.” The company says it worked with personal data protection as its top priority, and that an outside attacker unlawfully entered the server of the contractor to which it entrusted consultation work.

Seventy-Six Hours From Intrusion to Public Notice

Three timestamps in the notice can be put together. The attack is placed at about 04:00 KST on 12 November. The contractor’s report reached Coinone at about 09:20 KST the same day, a gap of 5 hours 20 minutes. The notice itself is stamped 08:00 KST on 15 November.

That is 76 hours from the intrusion to the public disclosure, and 70 hours 40 minutes from the moment Coinone says it learned. Korean outlets including Yonhap began publishing during the same morning, roughly three hours after the notice went up, which means the exchange told its own users before the wire services told them.

The comparison with an earlier case in this sector does not flatter it. BlockchainReporter reported on 28 October that Bithumb detected unauthorized access to its groupware on 27 October and confirmed the breach a day later , with employee data exposed and the customer-data question still open at the time. Coinone’s exposure is customer data by definition, and its gap between attack and disclosure is measured in days rather than hours.

Four Fields a Customer Cannot Replace

Split the eleven fields by what a customer can do about them and the notice becomes easier to read. Four are identity anchors that cannot be reissued at will: name, date of birth, resident registration number and the issue date on the identity document. Four are credentials or financial identifiers that can be rotated but carry immediate fraud value: password, bank account number, wallet address and transaction ID. Three are contact vectors that make a follow-up call or email convincing: phone number, email and home address.

The four identity anchors are the part of this breach that a password reset does not fix. A resident registration number is the thirteen-digit identifier Koreans use for identity checks across banking, telecoms and government services, and it is not reissued after a leak. Paired with a name, a date of birth, a bank account number and a home address, it is the raw material for a convincing impersonation, which is the risk the notice spends a full section warning about.

Why a Support Transcript Carries What the Trading Engine Never Touches

An exchange’s trading system stores balances, order history and hashed credentials. A support transcript stores sentences. The two datasets differ in kind, and the second exists because a human conversation needed the customer to prove who they were.

The notice’s remediation section shows what that produced in practice. “상담 중 비밀번호를 말씀하시거나 입력하신 적이 있다면 코인원 계정 비밀번호를 변경해 주시고, 같은 비밀번호를 쓰는 다른 웹사이트의 비밀번호도 함께 변경해 주시기 바랍니다.” Customers who ever said or entered a password during a consultation are told to change the Coinone password and any other site where the same one was reused. A password field sits in the leaked dataset because some consultations involved one.

This is the recurring shape of exchange breaches in 2026, and it is a vendor problem more than a trading-engine problem. BlockchainReporter covered Coinbase’s October disclosure, which it traced to the analytics vendor Amplitude while stating that its own systems were not compromised. The perimeter that failed in each case belonged to a third party holding a copy of customer data for support or analytics purposes.

Coinone’s separation argument is accurate and narrower than it first sounds. Accounts, trading and wallets do sit apart from the MetaM server, so the custody layer is intact. What sat on that server was the identity layer, and the identity layer is what account-recovery fraud and voice phishing consume.

Three Million Won Is a Statutory Ceiling

The notice sets out the legal route in more detail than most breach disclosures. Under the Personal Information Protection Act and the Act on the Use and Protection of Credit Information, a customer can claim damages without proving the company’s intent or negligence, because the burden of proof rests with the company. Where intent or gross negligence is established, a court may award up to five times the actual loss.

“법정손해배상 청구 : 손해액을 증명하기 어려운 경우 위 손해배상 대신 300만 원 이하의 범위에서 상당한 금액을 청구하실 수 있습니다.” The statutory route allows a reasonable amount up to 3 million won where the loss itself is hard to prove. At the 1,336.06 won per dollar rate quoted on 15 November, 3 million won is about $2,245. Spread across eleven exposed field types, that works out to roughly $204 per category of data.

Read that as a ceiling for a statutory claim rather than an expected payment, since courts hold wide discretion within the range. It is also the only figure in the notice that turns the exposure into money, and the one most readers will weigh against the value of the records a vendor was holding for them.

What the Notice Does Not Say

Six things are missing, and each one shapes how worried a customer should be.

Coinone does not disclose how many customers were affected. It does not say how many consultation records the server held. It does not say whether the records were encrypted at rest. It does not identify the attacker or describe the access method beyond illegal entry. It does not give the date of its reports to the three regulators. And it names no police complaint, listing only the Korea Internet and Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service.

The status of the consultation channel is also left open. The notice says the outsourced customer centre was switched to email consultation as an emergency measure. It does not say when phone and chat support return, which for a user trying to freeze an account is the practical question rather than the legal one.

Scale is absent from the other direction as well. Coinone’s 24-hour trading volume was about 4,540 bitcoin at the time of writing, near $298 million at a bitcoin price close to $65,700, on a profile that CoinGecko dates to 2016 and scores at 6 out of 10 for trust . A leak of support transcripts does not scale with trading volume, but the number of tickets an exchange of that size handles in a year gives some idea of the record pool a consultation vendor sits on.

What a Coinone User Can Do

Coinone’s login flow already requires a second factor on every session, through a one-time password or a KakaoTalk verification tied to the registered handset, and it says login attempts from unofficial apps are blocked automatically. “현재 유출된 일부 정보만으로는 제3자가 고객님의 계정에 로그인하거나 자산을 출금할 수 없습니다.” With only the leaked portion of information, the notice says, a third party cannot log in or withdraw assets.

That sentence is a statement about the platform, not about the customer’s life outside it. The steps the notice recommends are worth taking in order: change the Coinone password if it was ever disclosed in a consultation, change it anywhere else it was reused, review the withdrawal address book for entries you did not add, and treat any call, text or email that cites consultation details as an impersonation attempt.

The company’s own warning sets the rule for what it will never ask. “당사는 어떠한 경우에도 전화, 문자, 이메일로 비밀번호, OTP 번호, 인증번호를 묻거나, 가상자산 출금이나 지갑 주소 변경을 요청하지 않습니다.” Coinone says it does not ask for a password, OTP number or verification code by phone, text or email under any circumstances, and does not request a withdrawal or a wallet address change.

Disputes and reports go to the Personal Information Dispute Mediation Committee on 1833-6972 or kopico.go.kr , the privacy infringement centre run by the Korea Internet and Security Agency on 118 or privacy.kisa.or.kr , and the Financial Supervisory Service on 1332.

Frequently Asked Questions

---

Timestamps in this article are given in Korea Standard Time, which is UTC+9. The dollar conversion uses a 15 November rate of 1,336.06 won per dollar. Coinone’s notice is published in Korean and the quotations above are reproduced in the original with a translation by BlockchainReporter.