Four South Korean Data Leaks Put Customer Information Under Scrutiny

Changpeng Zhao, the founder of Binance, listed four incidents in an X post by Changpeng Zhao: an exposure involving Coinbase vendor Amplitude, a user-data leak at South Korean crypto exchange Bithumb, and separate incidents involving securities firms Mirae Asset and Daishin Securities.

Zhao said Amplitude exposed contact data belonging to some Coinbase users, while stressing that funds were unaffected. He also advised users to protect themselves against phishing, SIM swapping and social engineering. His post did not specify how many people were affected, what categories of contact information were exposed or how long the incident lasted.

The post did not say that the four events were connected. It also did not establish whether the Bithumb incident involved the exchange’s own infrastructure or an outside service provider. Those distinctions matter because the financial consequences and remediation requirements can differ substantially between a vendor compromise, an attack on an exchange’s internal systems and a broader compromise of customer accounts.

Reports detail the incidents

Crypto.news reported that Coinbase described the Amplitude incident as affecting a small subset of customer contact data. The report said Coinbase maintained that customer funds and accounts were not compromised. Contact information can still carry financial risk, however, because attackers can use it to identify active customers and tailor convincing messages.

The same report described Bithumb as suffering a breach of its internal systems involving user data. A separate Yonhap report on the financial-sector breaches said Bithumb experienced an external cyberattack involving customer information. The available reporting did not resolve the difference between those descriptions or identify the exact information accessed.

Yonhap reported that Daishin Securities disclosed a breach affecting 38,490 customers. It also said financial authorities had begun inspecting Mirae Asset following its reported incident. Neither account, as provided in the sources for this article, establishes that trading balances, securities holdings or payment systems were accessed.

The reports leave several material questions unanswered. They do not fully identify the exposed data, the dates of unauthorized access, the duration of any intrusion or whether passwords, identity documents, account numbers or authentication details were involved. They also do not explain whether affected customers will receive credit monitoring, password-reset instructions, fraud alerts or other protective support.

Data exposure can shift the attack surface

A leak does not need to include private keys or account balances to create a path toward financial loss. Email addresses and phone numbers can help attackers build credible impersonation campaigns. A message that appears to come from an exchange may direct a user to a fake login page, request a verification code or encourage the installation of malicious software.

SIM swapping creates a related risk. If attackers combine leaked personal details with information gathered from public profiles or other breaches, they may attempt to persuade a mobile carrier to transfer a victim’s phone number to a new SIM card. That can weaken text-message authentication and provide an opening for account recovery attacks.

For crypto users, the distinction between stolen data and stolen funds is therefore important but incomplete. The first incident may not move money immediately, yet it can reduce the cost of later social engineering. That is particularly relevant for exchanges, where customer support and account-recovery processes can become targets even when blockchain wallets and trading engines remain secure.

The incident also highlights the financial exposure created by third-party vendors. Companies often outsource analytics, communications, identity verification and customer-support functions. A vendor may hold enough information to make customers identifiable even without controlling withdrawals or trading accounts. The Amplitude report therefore extends beyond Coinbase itself and raises questions about how exchanges assess, monitor and limit the data accessible to service providers.

Authorities face pressure to clarify scope

SBS reported that Daishin found no evidence of secondary damage or access to core systems. The report also quoted Financial Supervisory Service Governor Lee Chan-jin warning that artificial intelligence-assisted hacking could make simultaneous attacks routine.

That concern adds a broader regulatory dimension. If attackers can automate reconnaissance, phishing and credential testing across multiple financial institutions, isolated incidents may become part of a coordinated campaign even when no connection has been demonstrated. Authorities and companies will need to establish whether the events share infrastructure, tactics or compromised suppliers before drawing that conclusion.

The sources reviewed for this article did not include a detailed response from Amplitude, Bithumb, Mirae Asset or Daishin beyond the disclosures and statements reported above. They also did not provide an opposing account that would settle the conflicting descriptions of the Bithumb incident.

Until companies and regulators publish fuller findings, customers should treat unexpected account messages as potential phishing attempts, avoid sharing one-time codes, use authenticator-based security where available and contact service providers through official channels. The immediate reports may concern data rather than assets, but the next stage of risk will depend on how that information is used and how quickly affected firms notify and protect customers.