Coinone Discloses Customer Data Breach at Support Contractor MetaM

South Korean exchange Coinone said an outside attacker broke into servers run by MetaM, its outsourced customer support provider, exposing personal data that may include resident registration numbers, bank account numbers and passwords.

According to Coinone's official notice, published Sunday, the intrusion happened at about 4 a.m. local time on November 12. Coinone learned of it at roughly 9:20 a.m. that day, after MetaM reported the problem. The exchange has not said how many customers are affected.

What may have been exposed

The potentially compromised fields are broad: names, phone numbers, email addresses, dates of birth, bank account numbers, passwords, resident registration numbers, ID issuance dates, home addresses, wallet addresses and transaction IDs. Coinone said the exact data varies by customer, and that users who never contacted support were not affected. It has not established that every listed category was accessed for every affected customer.

MetaM gave its own account in a November 14 disclosure, relayed by Yonhap. It said it detected suspicious activity after a customer-service outage at 6:03 a.m. on November 12, and found that phone numbers and consultation conversations had been accessed or removed. It reported the incident to KISA on November 13, isolated its servers, blocked suspicious IPs and brought in security specialists.

Coinone's response

Coinone stressed that its core systems were not the target. Its account, trading and wallet infrastructure runs separately from MetaM's servers, and the exchange said it found

"no evidence of a direct intrusion"

into those systems. It added that account access requires two-factor authentication, by OTP or KakaoTalk, so the leaked information alone would not allow logins or withdrawals.

The exchange blocked the attacker's IP address, moved outsourced support to email, and strengthened monitoring. It reported the incident to KISA, the Personal Information Protection Commission and the Financial Supervisory Service.

Phishing is the real exposure

The practical risk lies in social engineering. Coinone warned that fraudsters could impersonate the exchange using details from previous support conversations, and a record that pairs a name, a phone number and the content of such a conversation hands a scammer a ready-made script. The exchange flagged phishing, impersonation and identity theft. It told customers who shared passwords with support to change them, including any reused on other services, and said its staff never ask for passwords, OTPs or verification codes.

The notice also outlines possible compensation under South Korean law, including statutory damages claims of up to 3 million won when proving actual loss is difficult.

Wider regulatory backdrop

The disclosure lands as Seoul tightens its security posture. In October the Financial Services Commission found security deficiencies at 130 of 555 financial firms it reviewed. On November 12, the day of the intrusion, it said it would let exchanges suspend deposits and withdrawals when hacking is suspected, following incidents at GOPAX and Prabang.

Those measures are built around hacks that put exchange funds in motion. This case exposes a different weak point: a third-party vendor that holds identity data but sits outside the exchange's own perimeter. A withdrawal freeze is a lock on the vault door, and here the thief walked off with the visitor log instead, so the relevant safeguard is how closely exchanges supervise the contractors who handle their customers' information.