---
title: "Coinone Warns of Phishing and Identity Theft After Customer Service Breach"
description: "An attacker breached outsourced customer service provider MetaM, accessing support records that contained personal details, bank accounts, and passwords."
url: https://basisdesk.news/news/coinone-customer-data-breach-metam-phishing-warning
published: 2026-11-15T08:31:12.433Z
modified: 2026-11-15T08:31:12.433Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [BTC, ETH]
tags: [data breach, south korea, coinone, phishing, cybersecurity, regulation]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# Coinone Warns of Phishing and Identity Theft After Customer Service Breach

An attacker breached outsourced customer service provider MetaM, accessing support records that contained personal details, bank accounts, and passwords.

## At a glance

- **What happened:** Coinone warned customers that an attacker accessed support records via its outsourced vendor MetaM, exposing sensitive personal data and passwords.
- **Why it matters:** The breach exposes affected customers to targeted phishing and identity theft, though Coinone's core trading and wallet systems were not directly breached.
- **Who is affected:** Coinone customers who contacted the exchange's customer support center.
- **What's next:** South Korean authorities are reviewing the incident following Coinone's formal breach report.
- **Status:** enforcement
- **Primary source:** [Coinone warns of phishing, identity theft after customer data breach](https://cointelegraph.com/news/coinone-data-breach-phishing-identity-theft-customer-information?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound) — cointelegraph.com

## Key points

- An attacker breached customer support records at Coinone vendor MetaM, accessing personal details, IDs, bank accounts, and passwords.
- Coinone stated core exchange, trading, and wallet systems remain separate and uncompromised, with no direct internal breach detected.
- The breach follows recent South Korean FSC findings of security deficiencies at 130 financial firms and new withdrawal-freeze rules for exchanges.

## Editorial remark

- **Context:** South Korean regulators have stepped up oversight of crypto exchange infrastructure, with the Financial Services Commission finding security deficiencies at 130 financial entities during an October review.
- **Impact:** Coinone users who interacted with customer support face elevated risks of identity theft and targeted phishing; core wallet assets and trading engines remain uncompromised.
- **Watch:** South Korean regulatory findings and potential enforcement updates following Coinone's formal report to local authorities.

South Korean cryptocurrency exchange Coinone warned customers of potential identity theft and phishing risks after an intruder breached its third-party customer support provider [1]. The incident occurred when an attacker accessed systems run by MetaM, an outsourced support vendor, compromising customer service records viewed or extracted during support inquiries [1]. Coinone stated it discovered the intrusion on the same day the servers were breached [1].

According to Coinone, the exposed information includes full names, dates of birth, phone numbers, email addresses, national identification numbers, bank account numbers, residential addresses, crypto wallet addresses, transaction IDs, and passwords shared during support interactions [1]. The exchange noted that the specific records exposed vary by individual, and users who never contacted customer service were not impacted [1]. Coinone did not reveal the total number of affected users [1]. Users who submitted credentials during previous support sessions were urged to change them, as bad actors could deploy the stolen records for targeted [phishing scams](https://basisdesk.news/news/common-crypto-scams) [1].

## Exchange Infrastructure Intact Amid Regulatory Push

Coinone clarified that its internal trading, account, and custody wallet infrastructure remains uncompromised, as these core systems operate independently from MetaM's external servers [1]. The platform confirmed it reported the security incident to South Korean law enforcement and regulatory authorities [1]. Similar supply-chain vulnerabilities have previously affected major trading platforms, such as when a [Coinbase vendor breach](https://basisdesk.news/news/coinbase-vendor-amplitude-data-breach-funds-safe) exposed select user information while core funds remained isolated.

The disclosure aligns with increased regulatory scrutiny across South Korea's financial ecosystem [1]. In October, the Financial Services Commission (FSC) reported security deficiencies across 130 of 555 evaluated financial institutions [1]. Days before the Coinone disclosure, the FSC announced rules permitting digital asset exchanges to halt withdrawals upon suspecting a hack, while requiring continuous, 24-hour network monitoring [1]. At the time of writing, broader market sentiment remains constrained, with $BTC trading at $64,535 and $ETH at $1,796 amid extreme market fear.

## Sources

1. [Coinone warns of phishing, identity theft after customer data breach](https://cointelegraph.com/news/coinone-data-breach-phishing-identity-theft-customer-information?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound) — cointelegraph.com, 2026-11-15

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai