The Coinbase data breach reported on 28 October 2026 was not one leak, but part of a single day in which four financial and cryptocurrency firms disclosed that personal data had been exposed. Coinbase said some customer contact information was exposed in a security incident at Amplitude, a third-party analytics vendor, and insisted that its own systems had not been breached. On the same day in South Korea, the crypto exchange Bithumb, the brokerage Daishin Securities and the asset manager Mirae Asset Global Investments each reported a separate hacking or data-leak incident. Together, the disclosures, trending per news coverage across crypto, technology and financial outlets, raised the same uncomfortable question for customers in the United States, South Korea and beyond: if the platform itself was not hacked, why is personal data still at risk?
The short answer is that modern financial firms rely on a chain of outside vendors, internal work systems and remote-access services, and a weakness in any one link can expose customer details even when trading systems and customer funds stay untouched. That distinction matters, and this article keeps it in view throughout: what each company confirmed, what it said was not affected, and what was still unconfirmed at the time of writing. No single attacker had been confirmed as being behind all four incidents, and investigators in South Korea said they had not ruled out a connection between the three Korean cases. Readers should treat any figure that a company itself has not confirmed as provisional, however widely it is repeated online.
What happened in the Coinbase data breach?
Coinbase addressed the reports in a post on X from its Coinbase Support account on 28 October 2026. Its wording was deliberately precise. “Coinbase has not had a data breach,” the post said. “Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers.” The company added that it had found no evidence of unauthorised access to Coinbase systems, that customer funds were not impacted, and that it was notifying affected customers and regulatory agencies in accordance with its legal obligations.
Amplitude provides analytics that help businesses understand how people use their products, and Coinbase’s account suggests the exposure originated on the vendor’s side rather than in Coinbase’s core infrastructure. Coinbase did not disclose how many customers were affected, and it did not publish a complete breakdown of the fields exposed. That gap is where the most widely repeated number in this story comes from, and it needs careful handling. An account on X claimed, without citing a source, that contact details for more than 70,000 users had been obtained. A person describing himself as a partner and chief information security officer at the blockchain security firm SlowMist repeated the claim. Reporting by Unchained noted that it found no report from SlowMist itself, and that Coinbase did not address the 70,000 figure. The figure should therefore be treated as an unverified social-media claim, not as a confirmed total, until Coinbase or Amplitude publishes one.
Coinbase data breach: what was exposed, and what was not
What Coinbase did confirm was narrower than the online claims: contact data belonging to a small subset of customers. Reports citing the SlowMist-linked claims described the exposed details as email addresses and phone numbers. Coinbase has not confirmed that breakdown, and it has not confirmed the 70,000 figure. On the other side of the ledger, Coinbase said customer funds were not impacted, and reporting on the incident said passwords and private keys were not impacted. That combination — contact details out, money and login credentials apparently untouched — is exactly why this kind of leak is easy to underestimate. An email address and a phone number, on their own, do not empty an account. In the hands of a scammer who already knows which exchange a person uses, however, they are the raw material for the next attack: a convincing message, call or fake support page that asks the victim to hand over the code, password or approval that actually opens the account.
The vendor distinction also deserves a plain explanation. When a company says a vendor had the incident, it is saying the attacker did not break into its own trading or custody systems. That is reassuring as far as it goes, and it is consistent with Coinbase finding no evidence of unauthorised access to its systems. It does not mean customers are unaffected. If a vendor held customer contact data for analytics, and that data was exposed, the customer’s exposure is real even though the company’s own servers were not entered. The same pattern has appeared in other sectors: a breach at a supplier can put customers at risk while the main company’s systems stay intact, which is why large data breaches are now routinely traced back through the full chain of firms that held the data, not only the brand on the account.
This was also not Coinbase’s first data-exposure disclosure. In May 2025 the exchange disclosed a separate breach, reported as affecting less than 1 per cent of its monthly transacting users, with estimated reimbursement and remediation costs of up to 400 million dollars. Reporting on that earlier incident described bribed support agents and deeper personal data, including names, addresses and phone numbers, and put the number of affected users at roughly 69,461. The October 2026 Amplitude incident is a different event, with a different cause as described by Coinbase, and the two should not be merged. The comparison is useful for one reason only: it shows why contact-data leaks at a major exchange are taken seriously even when funds are untouched, because the 2025 case was followed by phishing and social-engineering campaigns that traded on the stolen details.
Bithumb hack: employee system breached, customer data still being checked
Bithumb, South Korea’s second-largest cryptocurrency exchange by trading volume, confirmed a different kind of intrusion. The exchange said an unauthorised outside party had accessed its internal mobile groupware system, operated through the third-party platform Daou Office, and that personal information was taken. The system is the one employees use to work and message each other. Bithumb detected abnormal traffic on 27 October, reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission, and said it was analysing the exact scope, including the possibility that member information was involved.
What was confirmed as exposed, at the time of writing, was employee information: names, work email addresses and mobile phone numbers, according to Yonhap News Agency reporting cited by Reuters and other outlets. Whether customer data was also exposed had not been established. An industry source told Yonhap that some personal information belonging to Bithumb customers had leaked, but Bithumb itself had not confirmed that, and no affected-user count had been disclosed. Bithumb said the breached system runs separately from its trading platform, so customer virtual assets could not be accessed through the breach, and no crypto funds were reported lost. It had not said whether deposits or withdrawals were disrupted. Customers should therefore read the Bithumb hack as confirmed for employee data, unconfirmed for customer data, and still under investigation — a materially different position from the confirmed customer figures at Daishin Securities, described below.
Daishin Securities data leak: 38,490 customers affected
Daishin Securities gave the clearest figures of any firm in the day’s disclosures. The brokerage said personal and credit information belonging to 38,490 customers had been leaked. It first detected signs of unauthorised access on 17 October, on a server supporting remote securities-account opening for discretionary investment services. Working with the Financial Security Institute, it reviewed about 60,000 requests disguised as legitimate service traffic over a 10-day investigation, blocked the internet addresses used in the attack, including addresses used to bypass access restrictions, and notified regulators. It confirmed the leak on 26 October, two days before the wider disclosures.
Eight categories of information were exposed, according to Aju Press reporting of the disclosure: customer names, email addresses, postal addresses, communications IDs, bank names, bank account numbers, Daishin securities account numbers and mobile phone numbers. Some reporting described some account and phone-number fields as encrypted, which would reduce — but not remove — the risk from those fields, and the precise encryption position for each category was not uniformly described across outlets. Daishin said it had notified affected customers and would compensate customers for any resulting damage in accordance with the law. For the customers involved, this is the most serious of the four incidents in data terms: unlike a contact-only leak, it combined identity details with bank and brokerage account identifiers, the kind of combination that makes impersonation and targeted fraud materially easier. It is also a reminder that a data breach at a single firm can expose far more than a password, and that customers often learn the full list of exposed fields only after the investigation, not on the first day.
Mirae Asset hack: internal systems viewed, investor data said to be unaffected
Mirae Asset Global Investments, the asset-management arm of the Mirae Asset group, confirmed a hacking incident affecting some of its web and internal business systems, while giving a more reassuring account of the scope than the other two Korean firms. The company said a hacker viewed data in some internal business systems, that access to information such as the names of some employees was confirmed, and that there was no access to services for individual investors. A company official said retail investor data was not leaked, that the firm does not hold unique identification information such as resident registration numbers, passport numbers or driver’s licence numbers, or sensitive information, and that there was no external access to such data.
The same account said there were no traces of direct intrusion into servers or databases and no malware infection, no financial losses and no disruption to major systems such as the company website, and that the access route had been blocked immediately. The scope was still being assessed by the authorities at the time of writing, and the company said it would work with outside security specialists to analyse the cause and scope. Readers should therefore treat the Mirae Asset position as the company’s initial account, not as a completed investigation: internal business data was viewed, employee names were confirmed as accessed, and the absence of investor harm is, for now, the company’s statement rather than a regulator’s finding.
Why the Coinbase data breach landed in a wider South Korea hacking wave
None of the three Korean disclosures arrived in isolation. South Korea’s Financial Services Commission said on 14 October that cyber incidents had been identified at 16 financial firms, with roughly 100,000 records exposed in that interim tally, before the latest disclosures. That wave had already covered banks, savings banks and capital firms. The Financial Supervisory Service activated its highest-level emergency response, formed a joint investigation team, sent inspectors to Daishin’s offices and launched an industry-wide security sweep across financial firms, brokerages and licensed virtual-asset service providers. Its governor, Lee Chan-jin, told a meeting with bank holding-company chairs that he understood a broad hacking incident had occurred at major financial investment companies the previous day, and urged stronger IT security.
Police also opened a preliminary investigation on the morning of 28 October into the breaches at Daishin Securities, Mirae Asset Global Investments and Bithumb, assigned to the same investigative team handling the earlier string of financial-sector hacks. Investigators said they were comparing the methods used in each case, had not ruled out the possibility that a single perpetrator targeted multiple institutions, and had confirmed no link between the cases. That is an important line to hold: a shared pattern and a shared investigative team are not proof of a shared attacker. Financial-sector cyberattacks have also been reported in other markets this month, which shows how quickly a local wave can look like a global one, even when each incident has its own cause. The Coinbase and Amplitude incident, on the evidence published so far, sits apart from the Korean cases: a vendor incident in the United States disclosed on the same day, not a confirmed part of the Korean investigation.
Coinbase data breach risks: phishing, SIM swapping and fake support
The practical risk from all four leaks is the same, and it does not require the attacker to hold a password. Binance founder Changpeng “CZ” Zhao listed all four incidents in a post on X on 28 October and warned that leaked exchange data is mostly used for phishing, SIM swapping and social engineering. A SIM swap works by convincing a mobile carrier to move a victim’s phone number onto a SIM controlled by the attacker, usually by impersonating the victim with personal details gathered from leaks, social media or phishing. Once the number is theirs, the attacker can intercept SMS codes and password-reset links that guard email, bank and cryptocurrency accounts. Leaked names, emails, phone numbers, addresses, identity documents and transaction records make that impersonation easier, and CZ warned that exposed home addresses and asset-holding information could also raise the risk of real-world extortion or robbery.
Customers should therefore expect a wave of messages that look unusually well-informed: emails or calls that correctly name the exchange, quote a real account detail, and urge urgent action. The tell is rarely bad grammar any more. It is pressure, a link or a phone number the customer did not seek out, and a request for a code, a password, a remote-access session or a transfer. No legitimate exchange, bank or carrier needs a customer to read out a verification code. Learning how to protect yourself online is, in this context, less about spotting one fake email than about removing the single points of failure — a reused password, SMS-only two-factor authentication, and a phone number that can reset everything else — before the messages arrive.
What to do now after the Coinbase data breach and the Korean leaks
If you hold an account with Coinbase, Bithumb, Daishin Securities or Mirae Asset, or you use any service that relies on Amplitude analytics, work through these steps in order, starting with the accounts that guard money and email. First, change to a unique, strong password on each financial and email account, using a password manager if you have one, and never reuse the same password across an exchange, a bank and an email inbox. Second, move two-factor authentication off SMS wherever an alternative exists: a passkey or hardware security key is the strongest option because it is bound to the real site and cannot be redirected by a SIM swap, and an authenticator app is the next best step. Third, put a PIN, number lock or port-out freeze on your mobile carrier account, so a SIM change or port cannot be made without that extra check, and make sure the email used for the carrier account itself has strong authentication.
- Use a separate email address for financial accounts where possible, and keep a private recovery email that is not used anywhere else.
- Review active sessions, connected devices and API keys on your exchange and email accounts, and sign out or revoke anything you do not recognise; stolen sessions can survive a password change until they are revoked.
- Turn on withdrawal address whitelists and anti-phishing codes where the exchange offers them, and check withdrawal and login history for anything you did not do.
- Go to services through the official app or a bookmark you created yourself, never through a link in an unsolicited message, and never forward a verification code to anyone, including someone claiming to be support.
- Watch for a sudden loss of mobile signal, unexpected SIM-update messages, or password-reset emails you did not request, and call your carrier from another line at once if any of those appear.
- Daishin customers should read any notification from the firm, keep a record of it, and contact the firm through its official channels if they see unfamiliar account activity; Daishin has said it will compensate customers for proven damage under the law.
None of these steps requires panic, and none of them should involve paying anyone for “protection” or sharing a screen with a caller who contacted you first. The firms involved have said funds were not affected in the Coinbase and Bithumb cases, and Daishin and Mirae Asset have given their own accounts of the scope. If you receive a message claiming to be from one of them, verify it by opening the official app or typing the known address yourself, and treat any message that asks you to act immediately as suspect until you have done so.
What happens next in the Coinbase data breach investigation?
Four questions remain open, and each will be answered by a different party. Coinbase and Amplitude have yet to publish a confirmed number of affected customers or a complete, verified breakdown of the exposed fields, and Amplitude’s own statement had not been separately reported in the coverage reviewed for this article. Bithumb has yet to confirm whether any customer or member information was taken, or how many people were affected. Mirae Asset’s assessment, and the regulators’ inspection of all three Korean firms, were still under way. And the police comparison of methods across the Korean cases has yet to establish whether the incidents share an attacker, a technique, or nothing more than a crowded month for South Korea’s financial sector.
Until those answers arrive, the safest reading of 28 October is also the simplest: four disclosures, four different confirmed scopes, one shared lesson. Contact data, employee details and account identifiers are valuable even when money is untouched, because they make the next fraud more convincing. Customers who tighten authentication, lock down their phone number and treat unsolicited contact with suspicion will have removed most of the value from the leaked data, whatever the final totals turn out to be. This article will be read against the firms’ own updates as they publish them; figures that are still attributed to social-media claims or to a single unnamed source should not be repeated as fact in the meantime.
Sources: Coinbase Support post on X, 28 October 2026, as reported by Cointelegraph, Unchained, CoinGape and TheNewsCrypto, 28 October 2026; SlowMist-linked 70,000-user claim as reported and qualified by Unchained, 28 October 2026, with no SlowMist report found and no confirmation from Coinbase; Reuters reporting via CoinDesk and Decrypt on Bithumb, Daishin Securities and Mirae Asset Global Investments, 28 October 2026, citing Yonhap News Agency; Aju Press reporting on Daishin Securities, 28 October 2026; Seoul Economic Daily reporting on the police preliminary investigation and Mirae Asset Global Investments, 28 October 2026; Financial Services Commission interim tally of 16 firms and about 100,000 records, 14 October 2026, as reported on 28 October 2026; Financial Supervisory Service statements by Governor Lee Chan-jin, 28 October 2026; Changpeng Zhao post on X listing the four incidents, 28 October 2026. The 70,000 Coinbase figure, the Bithumb customer-data question and the Mirae Asset scope are unconfirmed or under investigation as described above; the Daishin figure of 38,490 customers is the firm’s confirmed disclosure.