Coinone said an attacker accessed servers run by its customer support contractor, MetaM, around 4 a.m. Korean Standard Time on Nov. 12, 2026. Information from past support interactions may have been exposed across 11 categories, including names, passwords, bank account numbers and identification details. Customers who never contacted support are outside the incident’s identified scope, and not every affected customer necessarily had all 11 categories exposed. Coinone has not said how many customers were affected or exactly what information the attacker obtained.
Coinone disclosed the intrusion on Nov. 15 and said its trading systems, customer accounts and cryptocurrency wallets were not compromised. It said the information leaked so far was insufficient to log in or withdraw assets, but warned that messages referring to past support conversations could be impersonation attempts.
