Coinbase has denied reports of an internal hack after customer contact information was exposed through its third-party analytics provider, Amplitude. The Nasdaq-listed exchange confirmed on October 28 that a security incident at Amplitude impacted a small subset of Coinbase customer contact data, alongside information belonging to other Amplitude clients. Coinbase emphasized that customer funds remained safe and that its own security checks found no evidence of unauthorized access to its systems. Passwords, transaction histories, and customer assets were not compromised, according to the exchange.
A SlowMist security executive circulated an unverified claim involving more than 70,000 Coinbase users, though the exchange has not confirmed that figure. Coinbase said it is emailing affected customers and informing regulators under applicable laws, but has not disclosed the total number of impacted users. The exchange warned customers to remain vigilant against phishing attempts, including messages or calls impersonating Coinbase support staff.
Separately, three South Korean firms disclosed security incidents on October 28. Crypto exchange Bithumb reported unauthorized access to its internal mobile groupware system on October 27, which employees use for workplace communications. Bithumb reported the incident to the Korea Internet & Security Agency and the Personal Information Protection Commission, and stated that its trading infrastructure is isolated from the compromised system, so customer digital assets cannot be accessed through it. The exact scope of personal information exposure is still under investigation.
Daishin Securities confirmed that personal and credit information belonging to 38,490 customers was exposed after hackers targeted a server connected to its remote brokerage account opening service. The firm detected suspicious activity on October 17, blocked the IP addresses used by the hackers, and subsequently worked with the Financial Security Institute to examine approximately 60,000 requests disguised as legitimate traffic. Exposed records included names, email addresses, residential addresses, bank details, account numbers, and mobile phone numbers, though some data was encrypted. CEO Jin Seung-wook apologized and pledged tighter access controls.
Mirae Asset Global Investments disclosed a separate incident involving unauthorized access to certain internal web systems. The asset manager maintained that general investors' personal and credit information was not exposed, and no sensitive identification records, financial losses, malware infections, or service interruptions were reported. The company blocked affected access routes and notified the Financial Services Commission and Financial Supervisory Service.
Binance co-founder Changpeng Zhao (CZ) weighed in on the incidents, warning that leaked exchange information could be exploited for phishing, SIM swapping, and social engineering. He recommended using separate email addresses and phone numbers for crypto accounts, enabling authenticator apps or hardware security keys, and setting up withdrawal address whitelisting and anti-phishing codes. "You can't prevent a leak, but you can protect yourself," Zhao wrote.
The incidents follow other recent security events, including a Keystone hardware wallet breach disclosed on October 24 and a Foundation Passport phishing campaign linked to compromised Cloudflare access keys.
