Three Crypto and Finance Firms Disclosed Breaches on the Same Day. Here’s What Happened.
Wednesday, October 28, produced an unusual cluster: Coinbase, Bithumb, and Daishin Securities all disclosed data security incidents within hours of each other. None of the three reported direct losses of customer funds. All three involve customer or employee personal data, the kind of information that feeds phishing campaigns, SIM-swap attacks, and, for crypto holders, the physical “wrench attacks” that have risen 33 percent year-over-year in 2026. The incidents are unconnected, but the timing is a useful reminder of how fragmented the attack surface around financial data has become.
What Happened at Coinbase?
This morning, Coinbase Support posted on X that a security incident at Amplitude, a third-party analytics vendor, had exposed contact information for a “small subset” of Coinbase customers. Amplitude is a product analytics platform used by technology companies to track user behavior across their applications.
Coinbase said it found no evidence of unauthorized access to its own systems and stated directly: “Coinbase has not had a data breach.” The company said the exposed data was limited to customer contact information, without specifying whether that covered email addresses, phone numbers, names, or some combination. It did not disclose how many customers were affected, when the incident occurred, or how long the data was exposed. Coinbase said it is notifying affected users.
Plain-English version: Amplitude is a tool Coinbase uses to understand how customers use its product. To do that job, Amplitude receives some customer data. When Amplitude’s systems were compromised, that customer data went with it. Coinbase’s own infrastructure was apparently not touched.
The distinction matters, but it does not eliminate the risk. Because analytics vendors receive real customer data to function, a breach at the provider can expose information even when the client company’s own systems remain secure. Coinbase has not confirmed whether passwords, two-factor authentication details, or private keys were involved. Its statement indicated the exposure covered contact data only.
Coinbase earnings are due today, making this an awkward morning for the company’s communications team.
Context: Coinbase’s Second Data Incident in 18 Months
This is not Coinbase’s first vendor problem. In May 2025, Coinbase disclosed that cybercriminals had bribed overseas support agents to steal customer data, including names, addresses, phone numbers, email accounts, and images of government-issued IDs. The company estimated remediation costs at up to $400 million and declined to pay a $20 million ransom demand. That breach was traced in part to a third-party outsourcing firm.
Today’s incident is significantly smaller in disclosed scope, and the vector is different: a compromised analytics tool rather than a bribed insider. But the pattern of customer data leaving Coinbase’s control through the extended vendor network is consistent across both incidents.
Coinbase has not confirmed whether Amplitude’s breach was targeted at Coinbase specifically or was a broader incident affecting multiple Amplitude clients. Coinbase said the incident impacted a “small subset” of Coinbase customers along with other Amplitude clients, which suggests the latter.
What Happened at Bithumb?
On the same day, South Korea’s second-largest crypto exchange, Bithumb, confirmed it had discovered unauthorized access to its internal mobile groupware system on Tuesday. This is the platform employees use for internal communications and work. The exchange notified the Korea Internet and Security Agency and the Personal Information Protection Commission the day it discovered the breach.
Bithumb told Yonhap News Agency: “We are analyzing the exact scope, including the possibility of member information being involved. The internal work system is separated from the virtual asset trading system, so customer virtual assets cannot be accessed through this breach.” The investigation is ongoing, and whether customer records appeared in internal files or communications has not been confirmed.
The Korea Times reported that scanning activity preceding the Bithumb breach was identified as originating from IP address ranges classified as North Korean, though the publication noted that scanning can precede an intrusion without itself establishing a breach. Attribution has not been confirmed. Verify before publishing: North Korean attribution is from The Korea Times characterizing IP ranges, not from a government or security firm confirmation.
What Happened at Daishin Securities?
Daishin Securities confirmed a breach affecting 38,490 customers, with names, email addresses, telephone numbers, and other account-related details exposed. The company identified suspicious access on October 17 involving a server connected to online securities account-opening services. Daishin pledged compensation for losses under applicable laws.
Asset manager Mirae Asset Global Investments also disclosed a separate incident, with financial authorities investigating its extent.
A Wider South Korean Financial Sector Pattern
Today’s disclosures are not isolated. South Korea’s Financial Supervisory Service Governor Lee Chan-jin said cyberattacks had hit 16 South Korean financial institutions as of October 14 alone, a wave that began with a reported breach at Shinhan Bank in late September. Wednesday added Bithumb, Daishin Securities, and Mirae Asset to that list.
The pattern across all three Wednesday disclosures is that customer funds were not directly at risk in any case. What was exposed in each is personal and contact data, which carries its own threat model for crypto holders specifically: phishing at scale, SIM-swap attempts, and physical targeting.
Why It Matters
The attack surface around crypto does not end at the exchange login screen. Analytics tools, logistics partners, CRM vendors, internal communications platforms, and account-opening servers all touch customer data, and all of them can be compromised without the core trading infrastructure being touched at all. Wednesday’s three simultaneous disclosures are a useful illustration of just how wide that perimeter has become. If you are a Coinbase customer, watch for phishing attempts using your email address or phone number. If you are a Bithumb customer, consider the scope still unknown until the exchange provides its promised update. If you are a Daishin Securities customer, assume your contact details and account information are in the wrong hands and act accordingly.
