Four financial and cryptocurrency companies have reported separate data security incidents involving customer information and internal business data. The companies are Coinbase, Bithumb, Mirae Asset Global Investments, and Daishin Securities.
Coinbase confirmed that some customer contact information was exposed through its third-party analytics provider, Amplitude. In South Korea, Bithumb reported unauthorized access to its internal mobile groupware system, while Daishin Securities confirmed that information belonging to 38,490 customers had been exposed. Mirae Asset Global Investments also reported unauthorized access to certain internal business systems.
According to Reuters, the three South Korean incidents were reported on October 28, while Coinbase separately addressed the exposure linked to Amplitude.
Coinbase said its own systems were not compromised and that customer funds remained safe. The incident originated with Amplitude, an external analytics provider used by Coinbase and other companies.
The exposed information involved a small number of customer contact details, along with data belonging to other Amplitude clients. Coinbase has not disclosed the exact number of affected customers or provided a complete breakdown of the exposed information. The exchange said it was notifying affected customers by email in line with applicable legal requirements.
The incident follows another recent security breach involving Bitcoin hardware wallet maker Foundation. Attackers compromised Cloudflare API keys and sent fraudulent emails that appeared to come from official company domains. Foundation said its Passport devices and customer funds remained secure.
In South Korea, Bithumb confirmed that an unauthorized party accessed its internal mobile groupware system, which employees use for workplace communications. The exchange discovered the incident on October 27 and reported it to the Korea Internet & Security Agency and the Personal Information Protection Commission the same day.
Bithumb confirmed that personal information was exposed, but it is still investigating the full extent of the breach and whether customer account details were affected. The company said its internal work system is separated from its cryptocurrency trading infrastructure, meaning the compromised system cannot be used to access customers’ digital assets.
Bithumb is not the only South Korean cryptocurrency business facing security concerns. Regulators recently identified security incidents at 16 financial businesses, including Streami, the operator of Gopax, and virtual asset service provider Prabang.
Daishin Securities provided the clearest figures on the number of people affected. The brokerage confirmed that personal and credit information belonging to 38,490 customers was exposed after hackers targeted a server connected to its remote brokerage account opening service.
The company first detected suspicious activity on October 17 and blocked the IP addresses used by the attackers before reporting the incident to financial regulators. Working with the Financial Security Institute, Daishin examined around 60,000 requests disguised as legitimate service traffic over ten days. The breach was confirmed on October 26.
The exposed information covered eight categories, including names, email addresses, home addresses, communication IDs, bank names, deposit and withdrawal account numbers, securities account numbers, and mobile phone numbers.
Daishin said the bank account numbers, securities account numbers, and mobile phone numbers were encrypted. The brokerage has found no evidence of further damage or unauthorized access to its core operating systems.
Affected customers will receive individual notifications, and the company said it would compensate customers for losses directly caused by the breach in accordance with applicable legal procedures. CEO Jin Seung-wook apologized and promised stronger access controls, improved threat detection, and additional security checks for externally connected services.
Mirae Asset Global Investments reported a separate incident involving unauthorized access to certain internal web systems. The company said outsiders had viewed information used for internal business operations without proper access credentials, but maintained that investors’ personal and credit information had not been exposed.
According to the company, sensitive identification details, including resident registration numbers, passport information, and driver’s license details, were not compromised. Mirae Asset also reported no financial losses, malware infections, or service interruptions. Investigators had found no evidence of direct intrusion into its servers or databases.
The company blocked the affected access routes, notified the Financial Services Commission and Financial Supervisory Service, and hired an external cybersecurity firm to investigate.
Binance co-founder Changpeng Zhao, widely known as CZ, warned that leaked information such as names, email addresses, phone numbers, and transaction histories could be used for phishing attacks, SIM swapping, and social engineering.
CZ advised cryptocurrency users to limit the personal information they share with exchanges. Where possible, he recommended using separate email addresses and dedicated phone numbers for crypto accounts.
He also recommended using unique passwords and replacing SMS-based two-factor authentication with authenticator apps, hardware security keys, or passkeys.
Other protective measures include enabling withdrawal address whitelisting, setting withdrawal delays, and activating anti-phishing codes where available. Users should regularly review active login sessions and API keys, remove suspicious access, and limit API permissions to what is necessary.
To reduce the risk of SIM swapping, CZ suggested using mobile carrier security features such as port-out PINs and number locks. He also warned users not to trust unsolicited messages from people claiming to represent exchange support teams, particularly if they request passwords, authentication codes, or recovery phrases.
He further warned that leaked home addresses combined with information about cryptocurrency holdings could expose people to real-world extortion and robbery. He advised users not to publicize their holdings and, where possible, to keep large balances separate from information connected to their home addresses.
Anyone concerned about a data breach should change compromised or reused passwords, check whether their email address appears on Have I Been Pwned, remove suspicious login sessions and API keys, and review recent withdrawals for unauthorized transactions.