Coinbase Blames Vendor for Data Leak as 3 Korean Firms Report Breaches
October 28, 2026
Four Financial Firms Disclose Security Incidents in a Single Day
Coinbase said on Wednesday that contact details belonging to a “small subset” of its customers were exposed through a security incident at Amplitude, an analytics provider the exchange uses. The disclosure came the same day three South Korean financial firms, including the crypto exchange Bithumb, reported their own breaches. None of the four companies has reported stolen customer funds. But the cluster of disclosures has spotlighted a weak point that rarely makes headlines: the outside vendors and internal tools around an exchange, not the exchange itself.Coinbase Denies a Breach of Its Own Systems
According to Cointelegraph, Coinbase said it found “no evidence of unauthorized access to its own systems” and that customer funds were not affected. The exchange framed the incident as an Amplitude issue that also affected data belonging to other Amplitude clients. Coinbase has not said how many customers were affected or provided a full breakdown of the exposed information. Coinbase is notifying affected users by email. The episode carries extra weight because of Coinbase’s history. In May 2025, the exchange disclosed a separate breach affecting less than 1% of its monthly transacting users, and estimated reimbursement and remediation costs of up to $400 million. That earlier incident followed a familiar script: stolen personal details were later used to impersonate support staff and trick customers into handing over funds.Bithumb, Daishin and Mirae Asset Report Breaches in Korea
In South Korea, Bithumb said an unauthorized outside party had accessed its internal mobile groupware system, the platform employees use for workplace messaging. The exchange discovered the intrusion on Oct. 27 and reported it the same day to the Korea Internet & Security Agency and the Personal Information Protection Commission, Cointelegraph reported, citing Yonhap. Bithumb said it is “analyzing the exact scope, including the possibility of member information being involved.” It stressed that the work system is separate from its trading infrastructure, so the breach cannot access customers’ digital assets. Brokerage Daishin Securities disclosed the largest confirmed exposure. Hackers leaked personal and credit information tied to 38,490 customers after targeting a server linked to its remote account-opening service. The company detected suspicious activity on Oct. 17 and confirmed the breach on Oct. 26 after reviewing roughly 60,000 requests disguised as normal traffic. It said some fields, including account and phone numbers, were encrypted. Asset manager Mirae Asset Global Investments said outsiders accessed some internal web systems, but that investor personal and credit information was not exposed. Financial Supervisory Service Governor Lee Chan-jin said cyberattacks had hit 16 South Korean financial firms as of Oct. 14.
Why Leaked Contact Details Still Put Crypto Users at Risk
Here is the mechanism in plain terms. A leaked email address or phone number cannot move anyone’s crypto on its own. It gives a scammer a target list of people known to hold an account at a specific exchange. From there, the playbook is well established. Attackers send emails or texts that look like official security alerts, often claiming the account has been compromised and urging the user to “verify” it. The link leads to a fake login page, or the message asks the victim to call a fake support line. Some go further with SIM swapping, where a criminal persuades a mobile carrier to move the victim’s number to a new SIM card so that SMS login codes arrive on the attacker’s phone. This is why a “contact data only” leak still matters. The data is the first step, not the final one.CZ Urges Crypto Users to Tighten Account Security
Binance co-founder Changpeng Zhao responded to the wave of disclosures with a list of precautions in a post on X, as reported by crypto.news. He warned that leaked names, emails, phone numbers and transaction histories could enable phishing, SIM swapping and social engineering. His suggestions included using a separate email and dedicated phone number for crypto accounts, swapping SMS two-factor codes for authenticator apps, hardware keys, or passkeys, and enabling withdrawal whitelisting and anti-phishing codes. He also cautioned against replying to unsolicited “support” messages that ask for passwords, codes, or recovery phrases. Readers following crypto news today will recognise these steps from previous leaks.Will Vendor Risk Become the Next Regulatory Focus?
The Amplitude incident could sharpen questions about how much responsibility an exchange carries for the tools it plugs into. Coinbase says its own systems were not breached. For customers whose details are now exposed, that distinction may matter less than who held the data. In South Korea, the scale of the problem could prompt a tougher response. With 16 financial firms already hit this month, regulators may push for stricter checks on externally connected services, which Daishin itself has pledged to introduce. Last week’s case in which CoinDCX denied a second hack showed how quickly an exchange’s first statement can be tested by what follows.The Perimeter Around Exchanges Is Now the Target
Each of this week’s incidents shares one feature: attackers did not reach trading systems or wallets. They went through an analytics vendor, an internal messaging tool, an account opening server and internal web systems instead. That suggests exchange security is increasingly being tested at its edges rather than its core. Wallet infrastructure has been hardened over years of costly hacks, while the software around it, from marketing analytics to employee chat apps, often holds the same customer details with far less protection. For anyone who wants to buy crypto online, the account is only as safe as the weakest company holding a copy of their name and number.
Share Article
Madiha Riaz
Madiha is a seasoned researcher in cryptocurrency, blockchain, and emerging Web3 technologies. With a background in organic chemistry and a sharp analytical mindset, she brings scientific depth to decentralized innovation. Since discovering crypto in 2017 and investing in 2018, she’s been uncovering and sharing deep insights into how blockchain is redefining the digital asset landscape.
