Coinbase, Bithumb, Daishin Securities, and Mirae Asset Global Investments have all disclosed data security incidents involving the leakage of customer contact information and internal business information.

Coinbase It has been confirmed that a small amount of customer contact information has been leaked through their analytics service provider, Amplitude.

According to Bithumb, its internal mobile collaboration system was subjected to unauthorized access on October 27th, and an investigation is currently underway to determine the specific scope of personal information that may have been leaked.

Daishin Securities It has been confirmed that the personal and credit information of 38,490 customers has been leaked, including names, email addresses, bank information, and account numbers.

Mirae Asset Global Investments revealed that some of its internal business systems had been accessed without authorization.

According to Reuters, three of these four incidents were disclosed in South Korea on October 28th, while Coinbase was confirmed separately, indicating that customer information was leaked through a third-party analytics service provider Amplitude.

Coinbase Ensures Customer Fund Safety After the Amplitude Incident

Coinbase clarified that its own system was not compromised after reports of the leakage of some customers' contact information surfaced.

The exchange stated that the source of the incident was Amplitude, which is an external analytics service provider used by Coinbase and other companies as well. According to Coinbase Support, the leaked information involved a small portion of customer contact data, as well as related information of other Amplitude customers.

Coinbase has not disclosed the exact number of affected customers, nor has it provided a complete list of the leaked information. However, the exchange stated that customer funds are still safe, and its system has not detected any unauthorized access.

Affected customers will receive notifications via email in accordance with applicable legal requirements.

This incident occurred earlier this week following another security vulnerability, when Bitcoin hardware wallet manufacturer Foundation was attacked. The attackers stole the Cloudflare API keys and sent fraudulent emails that appeared to come from the company's official domain name; however, Foundation stated that its Passport devices and customer funds are still safe.

Bithumb Investigation into Customer Data Exposure Following Intrusion into Internal Systems

In South Korea, the cryptocurrency exchange Bithumb confirmed that unauthorized external parties accessed its internal mobile collaboration system, which is used by employees for work communication.

The exchange discovered this incident on October 27th and reported it to the Korea Internet Promotion Agency and the Personal Information Protection Commission on the same day.

Although personal information has been exposed, Bithumb is still investigating the exact scope of the leak, including whether customer account information is also among the affected records.

The company stated that its internal work systems are isolated from the infrastructure for cryptocurrency trading, therefore customers' digital assets cannot be accessed through the compromised system.

Bithumb is not the only Korean cryptocurrency company facing security issues recently.

As previously reported by crypto.news, regulatory authorities identified security incidents at 16 financial institutions earlier this month, including Streami, the operator of Gopax, as well as virtual asset service provider Prabang.

Daishin Securities Confirmed Data Breach Affecting 38,490 Customers

In these four incidents, Daishin Securities disclosed the most definitive number of affected customers.

A South Korean brokerage firm confirmed that hackers launched an attack on a server connected to its remote securities account opening service, resulting in the leakage of personal and credit information of 38,490 customers.

The company initially detected suspicious activity on October 17th, subsequently blocked the IP address used by the hackers, and reported the incident to financial regulatory authorities.

After cooperating with the Financial Security Institute, Daishin inspected approximately 60,000 requests disguised as normal service traffic within 10 days and confirmed a leak on October 26th.

The leaked records cover eight types of information, including customer names, email addresses, residential addresses, communication ID, bank names, account numbers for deposits and withdrawals, securities account numbers, and mobile phone numbers.

Daishin indicates that bank account numbers, securities account numbers, and mobile phone numbers have all been encrypted.

As of now, the brokerage firm has not discovered any evidence of secondary damage or unauthorized access to its core operating systems. Affected customers will receive separate notifications, and any losses directly caused by this breach will be compensated in accordance with applicable legal procedures.

CEO Kim Seung-wook ( Jin Seung - wook ) apologized to customers and pledged to strengthen access control, improve detection systems, and conduct further security checks on external connection services.

Mirae Asset states that customer information has not been affected

Mirae Asset Global Investments reported another incident involving unauthorized access to some of its internal web page systems.

The asset management company stated that external personnel viewed information used for internal business operations without legitimate access credentials. However, the company emphasized that the personal and credit information of ordinary investors was not leaked.

According to the company, sensitive identity records, including resident registration numbers, passport information, or driver's license information, were not affected.

Mirae Asset indicates that there were no financial losses, malware infections, or service interruptions, and investigators also found no evidence of direct intrusions into the servers or databases.

The company has blocked the affected access paths, notified the Financial Services Commission and the Financial Supervisory Agency, and hired an external cybersecurity firm to investigate the matter.

CZ It is recommended that encrypted users strengthen their account security.

Co-founder of Binance, Zhao Changpeng (often referred to as CZ), warned that the leaked exchange information, including names, email addresses, phone numbers, and transaction histories, could be used for phishing, SIM card theft, and social engineering attacks.

CZ It is recommended to minimize the personal information shared with exchanges. For example, where possible, use a separate email address and a dedicated phone number for your encrypted accounts.

In terms of account security, he recommends using separate passwords and replacing two-factor authentication based on text messages with verifier apps, hardware security keys, or passkeys.

Users can further protect their funds by enabling a withdrawal address whitelist, setting withdrawal delays, and, where supported, enabling anti-phishing codes. Regularly checking active login sessions and the API key helps to identify suspicious activities. At the same time, unused permissions should be removed, and access using the API should be minimized.

To prevent SIM cards from being hijacked, CZ mentioned security features provided by mobile operators, such as port transfer PIN codes and number locks. He also warned not to respond to unsolicited messages claiming to be from exchange customer service teams, especially when they request passwords, verification codes, or recovery phrases.

"The leaked addresses, combined with position data, have already led to real-life extortion and robbery. If possible, do not make your positions public, and try not to keep large amounts of money in any accounts that are associated with your home address," he added.

For anyone affected by a data breach, the immediate steps to take include: changing the leaked or reused passwords, checking if your email address appears on Have I Been Pwned, removing suspicious login sessions and API keys, and checking for any unauthorized transactions in recent withdrawals.

"You can't prevent leaks, but you can protect yourself," Zhao Changpeng wrote.