Overview
- An attacker breached MetaM, Coinone’s outsourced customer‑support contractor, on Thursday, November 12, and Coinone disclosed the intrusion on Sunday after investigators found evidence support records were viewed or taken.
- Coinone says its trading, account and wallet systems show no evidence of direct intrusion and that only users who previously contacted support may be affected.
- The records that may have been exposed include names, phone numbers, emails, dates of birth, bank account numbers, South Korean resident registration numbers, passwords, identity document dates, home addresses, crypto wallet addresses and transaction IDs.
- Coinone and MetaM isolated affected servers, blocked suspicious IPs, switched support to email‑only, brought in cybersecurity specialists, and reported the incident to KISA, the Financial Supervisory Service and the Personal Information Protection Commission.
- The breach highlights the risk of outsourcing support because third‑party systems concentrate sensitive customer data and could prompt tighter South Korean rules on exchange cybersecurity and more frequent inspections.