Coinbase, Bithumb and other Korean crypto firms report data incidents, with customer funds said to be untouched

Coinbase says its own systems were not breached and that the incident came through Amplitude, an analytics vendor. In South Korea, Bithumb reported unauthorized access to its internal mobile work system, while Daishin Securities and Mirae Asset Global Investments disclosed separate intrusions — the kind of vendor and internal-system issues that matter to any high-risk operator because they sit right next to customer data, regulatory reporting, and incident-response obligations.

1. Coinbase said on October 28, 2026 that “Coinbase has not had a data breach.” According to the exchange, Amplitude, an analytics vendor it uses, suffered a security incident that affected a small subset of Coinbase customer contact data, along with data belonging to other Amplitude customers. Coinbase said it found no evidence of unauthorized access to its systems and that customer funds were not impacted.
2. The exchange said the leak covered only a small portion of contact data, plus information about users of Amplitude, and that the full list of exposed data has not been disclosed. Coinbase also said impacted customers will be notified by email and that it is notifying regulatory agencies in line with its legal obligations.
3. Bithumb said it discovered unauthorized access to its internal mobile system, which employees use for work chat, on Tuesday, October 27. The exchange said it is still determining the scope of the data exposure, and it reported the incident to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission.
4. Bithumb said its internal work system is isolated from its crypto trading infrastructure, so hackers should not be able to access customer assets. For PSPs and exchanges, that distinction matters: a compromise in corporate tooling is still a reportable incident, but it is not the same operational problem as a trading-system breach.
5. Daishin Securities, a South Korean brokerage company working with tokenized securities, reported a separate breach tied to a remote account-opening service. It said hackers compromised data on 38,490 customers, including names, email addresses, home addresses, communication-system IDs, bank names, bank account numbers, brokerage account numbers, and mobile phone numbers. The company said it detected suspicious activity on October 17, blocked the attackers’ IP addresses, and notified financial regulators.
6. Mirae Asset Global Investments, which owns the crypto exchange Korbit, also reported unauthorized access to some of its systems. It said the attackers viewed information used for internal business operations, but that no personal or banking data was stolen, and that there were no financial losses, malware infections, or service outages.

One more data point from the same run of incidents: Foundation, the maker of the Passport hardware wallet, warned customers about phishing emails sent from official company domains after attackers obtained API keys from hosting provider Cloudflare. Different entry points, same uncomfortable lesson for high-risk businesses: the weak spot is often not the trading engine, but the layer around it.