Coinbase and Bithumb users have seen their data leaked after hackers targeted the South Korean crypto exchange and Coinbase’s analytics vendor.
The personal information of an unspecified number of Bithumb users was leaked after an “external party” reportedly breached its internal mobile groupware systems.
Meanwhile, Coinbase’s third-party analytics vendor Amplitude suffered a security incident that led to the leaking of user contact data.
Coinbase wants you to know it wasn’t its fault
Coinbase has been on damage control since the leak, stressing to users that the exchange itself wasn’t breached.
It said that only a “small subset” of users were impacted, and that there’s been “no evidence of unauthorized access to Coinbase systems, and customer funds were not impacted.”
Coinbase has not had a data breach. Amplitude, an analytics vendor, experienced a security incident which impacted a small subset of Coinbase customer contact data, among other Amplitude customers. We’ve found no evidence of unauthorized access to Coinbase systems, and… — Coinbase Support (@CoinbaseSupport) October 28, 2026
Coinbase’s response to the data breach affecting its users.
Read more: Coinbase leak prompts KYC criticism from crypto execs
Three more financial firms breached
South Korean TradFi firms Mirae Asset Global Investments and Daishin Securities also suffered a data breach yesterday.
Almost 38,500 Daishin Securities customers saw their credit card and personal details leaked, while Mirae customer details reportedly didn’t appear to have been leaked during the breach.
The situation in South Korea was bad enough that the country’s presidential office organised an emergency meeting to discuss the incidents.
Monero swap firm Wagyu has also reportedly suffered a data breach.
??????? lol these guys are so funny pic.twitter.com/fVuVO8JRFQ — Tay (@tayvano_) October 28, 2026
Read more: Coinbase says staff leaked customer data, refuses to pay $20M ransom
Customer data from the past three months, including transaction amounts and times, IP addresses, and country of origin, have been leaked by ransomware group WhiteArmor.
Wagyu reportedly refused to pay a $5 million ransom. WhiteArmor is also reportedly holding the Chinese electronics firm Hisense, and gambling firm Gamdom, to $5 million and $15 million BTC ransoms, respectively.
Coinbase and Bithumb have a history of leaks
Coinbase suffered a major data breach in 2024 when cybercriminals hired customer support staff to steal customer data.
The details of almost 70,000 users were impacted and the exchange refused to pay a $20 million BTC ransom.
Coinbase breach over Christmas exposed 70,000 users
Read more: Bithumb CEO booked in Korea over job offer bribe allegations
It also suffered a breach in December 2025 at the hands of a Coinbase contractor who accessed the data of around 30 users.
The data of 6,000 Coinbase users also appears to have been leaked in 2021, leading to a social engineering campaign that attempted to take over their accounts and steal their crypto.
Meanwhile, in 2017, 31,000 Bithumb users suffered a data leak that led to the theft of 5.9 million worth of crypto.
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
The post Coinbase and Bithumb users hit by data leaks appeared first on Protos.
