At a glance

  • South Korean exchange Coinone says an outside attacker entered the servers of MetaM, the company that handles its customer support, at about 04:00 Korea time on 12 Nov, and may have viewed or taken customer-support records, according to its notice.
  • The records may include names, phone numbers, passwords, bank account numbers and resident registration numbers, depending on what each customer said or typed in a chat or call. Customers with no support history are not affected, it says.

Coinone posted the notice at 08:00 Korea time on Sunday (23:00 UTC on Saturday, 04:30 IST). Our translation is from the Korean original, and The Herald Business, SBS News and Chosunbiz carry the same account.

MetaM is an outsourced vendor: a separate company that Coinone pays to answer customers. Coinone says MetaM told it of the intrusion at about 09:20 Korea time on 12 Nov, so about three days passed between Coinone learning of it and telling customers.

What may be exposed

Coinone lists 11 kinds of information that customers gave in support chats or calls: phone number, name, email address, date of birth, bank account number, password, resident registration number, ID issue date, home address, crypto wallet address and transaction ID.

A resident registration number is South Korea’s national identity number. It is the item most useful to someone trying to impersonate a customer.

Coinone says the list shows everything that could have leaked, and that what was actually exposed differs by person. It says it will tell each customer which items were involved, or offer a lookup service. It has not said how many customers are affected.

What Coinone says it has done

It says its account, trading and wallet systems run separately from MetaM’s servers and that it has seen no sign of a direct breach of them. It says every login needs a second factor, either a registered one-time-password device or an authentication prompt on the customer’s own phone, so that the leaked details alone cannot be used to log in or withdraw.

It says it blocked the attacker’s IP address and the vendor’s access, moved the outsourced support line to email, and increased monitoring of logins and trades. It reported the incident to the Korea Internet & Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service, and says it is checking the vendor’s security itself.

What we don’t know

Coinone has not said how many customers are affected, how the attacker got into MetaM’s servers, or whether any data has been published. It says the exact time and route of the leak are still under investigation.

We have not seen the leaked data, and we cannot check Coinone’s statement that the leaked items alone cannot be used to log in.

Why it matters: the exposed items are the kind used for phone and email scams, and for attempts to take over accounts. Coinone says it will never ask for a password, one-time code or verification code by phone, text or email, and will never ask a customer to withdraw crypto or change a wallet address. Anyone who typed or said their Coinone password in a support session should change it, and change it on any other site where it is reused, it says.

Next, watch for Coinone’s customer notifications and breach-lookup service, any finding from the three agencies, and a figure for how many customers are involved.

The incident follows a Korean exchange’s earlier breach of internal systems: Bithumb found unauthorised access to its staff messenger in October. Seoul has also told exchanges what to do when a hack is merely suspected: Korea will let exchanges freeze withdrawals on a suspected hack.

This article is for information only and is not investment advice.