Coinone Breach Leaks Passwords, Bank Accounts, and Resident IDs. Korea's Rules Guard the Coins, Not the Data.
South Korea's Coinone confirmed a customer data breach and warned users about phishing and identity theft. The exposed fields read like an identity kit: passwords, bank account numbers, national identification numbers, and wallet addresses. Seoul's licensing regime is strict about custody and thin on data, and that's the gap attackers keep walking through.
Coinone has a problem a blog post can't fix. The South Korean exchange confirmed a customer data breach this week and warned users about phishing and identity theft, and the list of potentially exposed fields is brutal. Passwords. Bank account numbers. National identification numbers. Crypto wallet addresses.
Four categories. Each one hurts on its own. Together, they're an identity kit.
That last detail matters more than it looks. A leaked wallet address lets an attacker check balances first and decide who's worth the effort. Pair it with a resident registration number, which in Korea still anchors bank verification, telecom signups, and plenty of property paperwork, and you've got the raw material for a very convincing impersonation call. Add a password and an account number, and credential stuffing stops being theoretical.
The regulatory angle is where this gets interesting. Korea's Virtual Asset User Protection Act, in force since July 2024, pushed exchanges hard on custody. It requires at least 80% of user deposits to sit in cold storage, demands reserves matched to liabilities, mandates insurance, and gives the Financial Services Commission real teeth. All of it aimed at the coins.
Almost none of it aimed at the databases.
That's the gap, and it's not small. Seoul has built one of the tightest licensing regimes on earth for how exchanges hold customer assets, and comparatively light rules for how they hold customer identity. The Act does require ISMS certification, but that's a checklist about process, not a promise about storage. Brussels, Washington, and Hong Kong are drawing different lines on this too, and none of them has fully solved the part where a server full of ID numbers is a liability no custodian can cold-store.
The compliance burden lands on Coinone first. Notification, remediation, and almost certainly a supervisory audit. The bigger cost is trust. Korean traders pick between a handful of licensed venues with real-name bank accounts, and a breach touching resident IDs gives every one of them a reason to move balances to a bank-linked account or a hardware wallet. Capital follows clarity. Right now the clearest signal Coinone can send is a fast, specific accounting of who was exposed and what it's paying for.