Coinbase says an incident at third-party analytics provider Amplitude exposed contact information belonging to a small number of its customers, but the exchange has found no evidence that its own systems were accessed without authorization. Customer funds were not affected. Separately, South Korean crypto exchange Bithumb and two financial institutions reported cybersecurity incidents, underscoring how exposed personal data can be used for targeted scams and account attacks even when crypto assets and custody systems are untouched.
Coinbase notifies customers as scope remains unclear
Coinbase said in a post on X on October 28 that the incident involved Amplitude and affected a small number of customers. The company is notifying affected customers and regulators, but has not disclosed how many people were affected or which specific contact details were exposed.
The exchange said it has found no evidence of unauthorized access to its systems and that customer funds remain safe. Current information points to exposure at a third-party service, rather than a breach of Coinbase’s core exchange systems or customer assets. The full scope of the incident has yet to be confirmed.
Three South Korean firms report security incidents
South Korean financial regulators opened an investigation on Wednesday. Brokerage Daishin said it confirmed that personal and financial information belonging to 38,490 customers had been exposed after detecting suspicious activity on October 17. The information included names, email and residential addresses, login IDs, bank names, and encrypted account numbers and phone numbers. Daishin said it had found no unauthorized access to core operating systems and no evidence that the information had been misused.
Bithumb said attackers accessed an internal employee communications system, exposing information relating to employees, subsidiaries and business partners. The exchange is still investigating whether customer records were also affected. South Korea’s Financial Services Commission said it had not confirmed any exposure of wallet addresses or information that could enable fraudulent cryptocurrency transfers.
Mirae Asset Global Investments said it detected unauthorized access to an internal web system, but investor information and sensitive financial records were not affected. The disclosures prompted an emergency meeting and on-site inspections by regulators. A total of 16 South Korean financial institutions had previously been affected by cybersecurity incidents.
CZ warns exposed data can fuel targeted attacks
Binance founder Changpeng Zhao, known as CZ, said on X that four data leaks had occurred that day. He warned that criminals could use customer records for phishing, SIM-swapping and social-engineering attacks. If an exposed address is linked to information about cryptocurrency holdings, investors could also face a greater risk of extortion or robbery, he said.
The incidents are not limited to exchanges. This year, security events have also affected Israeli crypto broker Bits of Gold and hardware wallet maker Trezor. Bits of Gold disclosed in August that attackers had accessed its analytics infrastructure. Customer names, contact details, Israeli identity numbers, bank information and public wallet addresses may have been affected.
An incident at Trezor logistics provider ShipMonk exposed customer names, phone numbers and delivery addresses. In a separate September incident involving Trezor email provider Brevo, 347,149 marketing email addresses were exported. Fraudulent emails were later sent in an attempt to obtain users’ wallet recovery phrases.
Zhao advised users to use separate email aliases and phone numbers for exchange accounts, and to favor passkeys or hardware security keys over SMS verification. He also cited withdrawal limits, regular reviews of account sessions and API permissions, and caution toward unsolicited messages claiming to come from exchange support. The affected information and confirmed scope differ across these cases, and some investigations remain ongoing.