Coinone’s outsourced customer service provider MetaM’s server was hacked, potentially exposing 11 categories of data, including customers’ names, bank account numbers, and resident registration numbers. The company has switched customer service to email-only operations and notified South Korean authorities. (Previously: Received a hacker threat! South Korean crypto exchange GOPAX suspends all trading and moves assets into cold wallets) (Background: South Korean exchange Upbit hacked for $30.4 million! Its parent company Dunamu, recently acquired by Naver, promises full reimbursement) South Korea’s third-largest cryptocurrency exchange, Coinone, confirmed on Sunday that hackers had breached its outsourced customer service system. Information customers had shared during past phone calls and online chats—including names, bank account numbers, and even resident registration numbers—may be among the data exposed. According to an announcement on Coinone’s website, an external attacker illegally accessed the servers of MetaM (메타엠), the company contracted to handle customer service, at around 4 a.m. on November 12. Customer service records stored there were viewed or taken. Coinone said it learned of the incident after MetaM notified it at around 9:20 a.m. that same day. Coinone listed the categories of information that may have been exposed: phone numbers, names, email addresses, dates of birth, bank account numbers, passwords, resident registration numbers (South Korea’s national identification numbers), ID issuance dates, home addresses, wallet addresses, and transaction IDs (TXIDs)—11 categories in total. Coinone stressed that this list covers all categories that may have been affected. Since the information provided by each customer during each inquiry varies, the specific information exposed will differ from person to person. Regarding the scale of the impact, Coinone clearly stated that customers who had never contacted its customer service center were not affected by this incident, but it did not disclose how many customers’ data had been accessed. The company said it would provide a separate service for checking personal data exposure so customers could find out which of their information may be at risk. On the issue customers care about most—asset security—Coinone said that member accounts, trading systems, and virtual asset wallets operate separately from MetaM’s servers, and that there is so far no indication that they were directly breached. The company also emphasized that all logins require a second layer of verification: in addition to entering the correct password, users must verify through either an OTP they registered themselves or KakaoTalk authentication on their own phone. Login requests from unofficial apps are automatically blocked, so the leaked information alone cannot be used to log in to accounts or withdraw assets. In response to the incident, Coinone said it immediately suspended outsourced phone and live-chat support once it received confirmation, switching to an email-only service. It also blocked the unauthorized access route and will conduct a comprehensive review of its own and its partners’ information security management systems. The company also warned that criminals might use details learned during earlier conversations to impersonate Coinone and scam customers. Customers should be alert to suspicious calls, emails, or text messages, and change any passwords they provided during support inquiries. Why outsourced customer service became the weak link The most notable aspect of this incident is that the breached system was not the exchange’s core accounting system, but the third-party customer service provider that handles phone calls. Similar scenarios have repeatedly played out across the global crypto industry: exchange partners leak customers’ contact information, exposing tens of thousands of users to phishing risks, while the exchanges’ core systems remain comparatively difficult to breach directly thanks to layers of isolation and multi-factor authentication. When exchanges outsource customer service, marketing, cloud services, and other operations to external vendors, their security responsibilities do not get outsourced with them. The strength of a small partner’s server defenses directly determines the baseline security of exchange customers’ data. South Korean regulators tighten measures the same week The timing is particularly sensitive. On the same day Coinone was notified that its customer service servers had been breached (November 12), South Korea’s Financial Services Commission (FSC), chaired by its vice chairman, held a “Virtual Asset Industry Security Measures Meeting.” It said that the industry had recently seen “a succession of information leaks and cybersecurity incidents,” and approved several measures. The meeting required businesses to establish round-the-clock monitoring and response systems. Businesses unable to remain on call around the clock may process deposits and withdrawals only during the hours they can maintain monitoring, and must inform customers in advance. Another key decision was to allow businesses to preemptively freeze deposits and withdrawals when they suspect a hack. The FSC noted that the current Virtual Asset User Protection Act permits suspension of deposits and withdrawals only when a hacker attack has been definitively confirmed. Cases such as Binance show that the faster access is cut off, the more customer losses can be reduced. The FSC will therefore issue businesses a “no-action opinion” to remove concerns about illegality for exchanges that intervene in advance. The meeting also called for increasing the proportion of customer assets held in cold wallets to the maximum possible level. The current regulatory minimum is 80%, while the industry’s actual average already exceeds 95%. Businesses were encouraged to minimize hot wallet balances and distribute them across multiple wallets, while also increasing insurance coverage limits and reserve levels. The FSC also pointed out that membership in the Financial Security Institute has low coverage: only five of the 28 virtual asset businesses—won-market exchanges—have joined. It will encourage the remaining businesses to join so they can access threat intelligence sharing, vulnerability assessments, and security education on par with financial institutions. Businesses genuinely unable to join will also receive support similar to that provided to small and medium-sized financial institutions. A draft Digital Asset Act, still under review by the National Assembly, will require digital asset businesses to assume information technology security obligations and liability for damages, just like financial institutions. Related articles Could South Korea’s third-largest crypto exchange Coinone change hands? Korea Investment & Securities reportedly plans to acquire a stake, in a move to counter Mirae Asset Group Coinbase denies being hacked! Customer contact data leak traced to Amplitude Data of 69,000 Coinbase users leaked) Official: Up to $400 million in compensation; refuses to pay hacker ransom Personal data of 46,000 TSMC employees offered on the dark web for 3 bitcoins; company confirms leak but stresses its systems were not breached SafePal data leak reported: Personal information from orders of nearly 40,000 customers exposed; assets and private keys remain safe South Korea’s third-largest exchange Coinone’s outsourced customer service hacked! Names, ID numbers, and bank account numbers may have been exposed This article was first published by BlockTempo (動區動趨, the most influential blockchain news outlet).