Four financial and cryptocurrency companies disclosed separate data security incidents on October 28, 2026, exposing customer contact details and internal business information. Coinbase, Bithumb, Daishin Securities and Mirae Asset Global Investments each confirmed unrelated breaches within the same day, with three of the four incidents reported in South Korea.
Coinbase Confirms Vendor Breach
Coinbase Support stated directly that the exchange itself had not suffered a data breach, clarifying that the incident originated at Amplitude, a third-party analytics provider used by Coinbase and other companies, which experienced a security incident affecting a small subset of Coinbase customer contact data. The company said no unauthorized access to its own systems was detected and that customer funds remained safe throughout the incident, according to CoinDesk. Coinbase did not disclose the total number of affected customers or provide a full breakdown of the exposed data, though affected users are being notified by email in line with applicable legal requirements, per crypto.news.
Bithumb Investigates Internal System Hack
South Korea's Bithumb confirmed that an unauthorized external party accessed its internal mobile groupware system, a tool employees use for workplace communications, according to Reuters. The exchange discovered the breach on October 27, 2026 and reported it to the Korea Internet & Security Agency and the Personal Information Protection Commission that same day. Bithumb said its internal work system is isolated from its cryptocurrency trading infrastructure, meaning customer digital assets could not be accessed through the compromised system, though the exchange is still investigating whether customer account information was among the exposed records.
Daishin Securities Discloses Clearest Numbers
Daishin Securities confirmed that personal and credit information belonging to 38,490 customers was exposed after hackers targeted a server connected to the brokerage's remote account-opening service, according to Reuters. The firm first detected suspicious activity on October 17, 2026 and worked with South Korea's Financial Security Institute to examine roughly 60,000 requests disguised as legitimate service traffic over a ten-day period before confirming the breach on October 26, 2026. The exposed records spanned eight categories, including names, email addresses, residential addresses, bank names and account numbers, though Daishin said bank account numbers, securities account numbers and mobile phone numbers were encrypted, according to crypto.news.
Mirae Asset Reports Internal System Access
Mirae Asset Global Investments disclosed unauthorized access to certain internal web systems used for business operations, according to Reuters. The asset manager said general investors' personal and credit information was not exposed, and that no sensitive identification records, including resident registration numbers, passport details or driver's license information, were compromised. Mirae Asset reported no financial losses, malware infections or service interruptions, and said its investigation found no evidence of direct intrusion into its servers or databases.
Part of a Broader Pattern in South Korea
The four disclosures follow a wave of security incidents affecting South Korean financial institutions throughout October 2026, with regulators identifying breaches at 16 financial businesses earlier in the month, including Streami, the operator of crypto exchange Gopax. The incidents also follow a separate breach at Bitcoin hardware wallet maker Foundation, where attackers compromised Cloudflare API keys to send fraudulent emails appearing to originate from the company's official domains, though Foundation said customer funds and devices remained secure, per CryptoBriefing.
What This Means for Affected Customers
Exposed contact details such as names, email addresses and phone numbers can be used to craft convincing phishing messages or attempt SIM-swapping attacks against affected individuals, a risk that grows when multiple unrelated leaks occur in close succession. Daishin's disclosure carries the most concrete exposure among the four incidents, with 38,490 customers' unencrypted names, emails and addresses now confirmed as compromised, according to Reuters. Coinbase, Bithumb and Mirae Asset have not disclosed exact figures for the number of customers affected by their respective incidents.
