South Korean cryptocurrency exchange Coinone has disclosed that an attacker accessed customer-support data held by MetaM, an outsourced service provider, in a breach detected on November 12. Coinone published its notice on November 15 after an initial investigation with the vendor. The exchange said customers who have never contacted its support service are not affected. It has not disclosed how many people were involved, and it said the specific information exposed differs from one customer to another.

The intrusion occurred inside a support vendor

According to Coinone's notice, the unauthorized access began at about 4:00 a.m. Korea Standard Time on November 12. MetaM informed Coinone at around 9:20 a.m. that day. The exchange said the attacker accessed the vendor's servers and may have viewed or taken data associated with customer-support cases. Independent reporting by Herald Business corroborated the timeline and the separation between the vendor environment and Coinone's own exchange infrastructure. Coinone has not identified the attacker or described the technical method used to enter MetaM's systems.

Related reporting: Binance Reopens Withdrawals Across 87 Networks After Security Breach

Potentially exposed fields vary by support case

Coinone said the affected support records may contain phone numbers, names, email addresses, dates of birth, bank-account information, passwords, resident registration numbers, identification-document issuance dates, home addresses, cryptocurrency wallet addresses and transaction identifiers. That list describes the range of fields that could be present in different support interactions; it does not mean every listed field was exposed for every affected person. The exchange said it is continuing to determine the exact data involved for each customer. No verified total for affected accounts was provided in the notice or independent report.

Coinone says core exchange systems were not breached

The company said its account, trading and cryptocurrency wallet systems operate on infrastructure separate from MetaM's customer-support environment. It said there is currently no evidence that those core systems were directly accessed in the incident. Coinone also said all account logins require a second authentication factor and that the partial information potentially taken from support records would not, by itself, be sufficient to log in or withdraw assets. Those statements reflect the investigation's current findings rather than a final technical report.

Access was blocked and regulators were notified

Coinone said it blocked the attacker's internet address and access route, increased monitoring and shifted vendor-provided customer assistance to email while reviewing the incident. The exchange reported the matter to the Korea Internet & Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service. It is also examining MetaM's security controls and the extent of the exposed information. The notice did not provide a completion date for that work or announce any financial loss connected to the incident.

Customers are being warned about impersonation

The exchange advised customers to be cautious about calls, messages or emails that impersonate Coinone and use personal details to solicit additional information or transfers. It said anyone who shared a password during a support interaction should change it, including on other services where the same password was reused. Coinone said it would contact affected customers individually as the investigation clarifies their exposure. The episode highlights a recurring security boundary for digital-asset businesses: sensitive information can be compromised through an external support provider even when the exchange's trading and wallet infrastructure remains isolated.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.