Coinone Contractor Server Breach Exposes Customer Support Data to Potential Leak
Key Facts
Coinone said on November 15, 2026, that an external attacker accessed a server belonging to MetaM, its customer-service contractor, on November 12 at around 04:00 a.m. The exchange said it learned of the incident that same day, after receiving a report from the contractor at around 09:20 a.m. It said support chat records were viewed or may have been taken, and that the data potentially exposed varies by customer depending on what they shared in their communications with the service center. The company published its notice at 08:00 on November 15, three days after the unauthorized access it identified. It said the exact timing and circumstances of the leak remain under investigation in cooperation with the contractor and specialized agencies.
The categories of data Coinone said may have been compromised include phone numbers, names, email addresses and dates of birth, as well as account numbers, passwords, national identification numbers and their issue dates. Records may also contain home addresses, wallet addresses and transaction identifiers, details that may vary among customers according to information they provided during support chats or calls. Coinone did not specify the number of affected customers, and the company had not disclosed the figure, according to Cointelegraph. The exchange said customers who had never contacted its support center were not affected by the leak. It plans to prepare a separate notice or inquiry service so each customer can find out which of their data is involved, with further details to be announced after confirmation.
Coinone said members' accounts, trading systems and virtual-asset wallets operate separately from the MetaM server. It said it had found no signs of a direct breach of those systems as of the notice's publication, placing the incident within the contractor's customer-service server. The company did not say that all the data listed had actually been leaked; it described them as categories that may have been exposed, with the details varying by customer. It added that two-factor authentication is applied to all logins. According to the exchange, the information that may have been leaked on its own is not enough for a third party to access an account or withdraw assets.
Coinone said it blocked the internet addresses used in the attack and cut off the access route to its customer center, while strengthening real-time monitoring for unusual communications and transactions. It shifted the service previously provided by the contracted support center to email communication. The exchange notified the Korea Internet & Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service, and said it is cooperating with the investigation and reviewing the contractor's security. MetaM and specialized agencies are investigating to determine exactly when and how the leak occurred, according to the company's disclosure. Coinone said it would announce developments as soon as additional information is confirmed.
The exchange warned that the data could be exploited in scam calls, phishing messages, spam emails or identity impersonation, including attempts to pose as Coinone. It advised customers who had previously shared a password while contacting support to change it. It also stressed that customers should not share passwords, one-time verification codes or verification codes with the exchange by phone, message or email. The exchange urged customers to treat any contact or message referring to details of a previous support conversation with caution, as it could be an impersonation attempt. This guidance remains in place as the company monitors unusual communications and transactions.