Four financial and cryptocurrency companies have reported data security incidents involving customer contact details and internal business information, with Coinbase, Bithumb, Mirae Asset Global Investments and Daishin Securities disclosing separate breaches.

According to Reuters, three of the incidents were reported in South Korea on October 28, while Coinbase separately confirmed that customer information had been exposed through its third-party analytics provider Amplitude.

Coinbase says customer funds are safe after Amplitude breach

Coinbase has clarified that its own systems were not compromised after reports emerged that some customer contact information had been exposed.

The exchange said the incident originated at Amplitude, an external analytics provider used by Coinbase and other companies. According to Coinbase Support, the exposed information involved a small subset of customer contact data, alongside information belonging to other Amplitude clients.

Coinbase did not disclose how many customers were affected or provide a complete breakdown of the information exposed. However, the exchange maintained that customer funds remained safe and that its systems had not detected unauthorized access.

Affected customers are being notified through email in accordance with applicable legal requirements.

The incident follows another security breach involving Bitcoin hardware wallet maker Foundation earlier this week. Attackers compromised Cloudflare API keys and sent fraudulent emails that appeared to originate from official company domains, although Foundation said its Passport devices and customer funds remained secure.

Bithumb investigates customer data exposure after internal hack

In South Korea, cryptocurrency exchange Bithumb confirmed that an unauthorized external party had accessed its internal mobile groupware system, which employees use for workplace communications.

The exchange discovered the incident on October 27 and reported it to the Korea Internet & Security Agency and the Personal Information Protection Commission that same day.

While personal information was exposed, Bithumb is still investigating the exact scope of the breach, including whether customer account information was among the compromised records.

The company said its internal work system is isolated from its cryptocurrency trading infrastructure, and therefore customer digital assets cannot be accessed through the compromised system.

Bithumb is not the only South Korean cryptocurrency business to face security concerns recently.

As previously reported by crypto.news, regulators identified security incidents at 16 financial businesses earlier this month, including Streami, the operator of Gopax, and virtual asset service provider Prabang.

Daishin Securities confirms leak affecting 38,490 customers

Among the four incidents, Daishin Securities has disclosed the clearest figures on the number of customers affected.

The South Korean brokerage confirmed that personal and credit information belonging to 38,490 customers was exposed after hackers targeted a server connected to its remote brokerage account opening service.

The company first detected suspicious activity on October 17 and subsequently blocked the IP addresses used by the hackers before reporting the incident to financial regulators.

Working with the Financial Security Institute, Daishin examined approximately 60,000 requests disguised as legitimate service traffic over ten days before confirming the breach on October 26.

The exposed records covered eight categories, including customer names, email addresses, residential addresses, communication IDs, bank names, deposit and withdrawal account numbers, securities account numbers and mobile phone numbers.

Daishin said bank account numbers, securities account numbers and mobile phone numbers were encrypted.

So far, the brokerage has found no evidence of secondary damage or unauthorized access to its core operating systems. Affected customers will receive individual notifications, while any losses directly caused by the breach will be compensated through applicable legal procedures.

CEO Jin Seung-wook apologized to customers and pledged tighter access controls, stronger detection systems and further security checks on externally connected services.

Mirae Asset says customer information was not compromised

Mirae Asset Global Investments reported a separate incident involving unauthorized access to certain internal web systems.

The asset manager said outsiders had viewed information used for internal business operations without legitimate access credentials. However, it maintained that general investors’ personal and credit information had not been exposed.

According to the company, no sensitive identification records, including resident registration numbers, passport details or driver’s license information, were compromised.

Mirae Asset reported no financial losses, malware infections or service interruptions, and said investigators had found no evidence of direct intrusion into its servers or databases.

The company blocked the affected access routes, notified the Financial Services Commission and Financial Supervisory Service, and engaged an external cybersecurity firm to investigate the incident.

CZ advises crypto users to strengthen account security

Binance co-founder Changpeng Zhao, commonly referred to as CZ, warned that leaked exchange information, including names, email addresses, phone numbers and transaction histories, could be exploited for phishing, SIM swapping and social engineering.

CZ suggested limiting the amount of personal information shared with exchanges, including using separate email addresses and dedicated phone numbers for cryptocurrency accounts where possible.

For account security, he recommended using unique passwords and replacing SMS-based two-factor authentication with authenticator apps, hardware security keys or passkeys.

Users can further protect their funds by enabling withdrawal address whitelisting, setting withdrawal delays and activating anti-phishing codes where supported. Regular checks of active login sessions and API keys can help identify suspicious activity, while unused permissions should be removed and API access kept to a minimum.

To prevent SIM swapping, CZ pointed to security features offered by mobile carriers, such as port-out PINs and number locks. He warned against responding to unsolicited messages from people claiming to represent exchange support teams, especially when they ask for passwords, authentication codes or recovery phrases.

“Leaked addresses plus holdings data have led to real-world extortion and robberies. Don’t publicize your holdings, and keep large balances out of anything tied to your home address if you can,” he added.

For anyone affected by a data breach, the immediate steps include changing compromised or reused passwords, checking whether their email addresses appear on Have I Been Pwned, removing suspicious login sessions and API keys, and reviewing recent withdrawals for unauthorized transactions.

“You can’t prevent a leak, but you can protect yourself,” Zhao wrote.