Key Notes
- The four disclosures involve different systems and do not establish a single coordinated attack.
- Daishin confirmed 38,490 affected customers while Bithumb is still checking for customer-data exposure.
- CZ recommends stronger authentication and withdrawal controls to limit follow-up scams.
Security disclosures involving Coinbase, Bithumb, Daishin Securities and Mirae Asset Global Investments have put personal-data protection back in focus across crypto and traditional finance. The cases involve different systems and different levels of confirmed exposure, rather than an established single attack.
Daishin has confirmed that 38,490 customers were affected. Coinbase acknowledges a limited contact-data exposure at a vendor, while Bithumb is still checking whether customer information was involved. Mirae Asset says the material accessed was internal business data, excluding ordinary investors’ information.
Binance founder Changpeng Zhao, known as CZ, highlighted the disclosures in an October 28 post and offered steps to reduce phishing and account-takeover risks. His broad description of the incidents should be read alongside each company’s more specific account below.
Read CZ’s account-security recommendations following the data-leak reports.
— CZ (@cz_binance) October 28, 2026
Coinbase: Vendor Contact Data, With No Confirmed User Count
Coinbase Support said an incident at analytics provider Amplitude affected a small subset of customer contact data, alongside information belonging to other Amplitude clients. Coinbase said it found no evidence of unauthorized access to its own systems and that customer funds were unaffected.
A claim circulating online put the number above 70,000 users. Coinbase has not confirmed that figure or supplied a complete list of exposed fields. Our earlier report separates the company’s statement from that unverified count.
Bithumb: Customer Information Remains Under Review
The South Korean exchange confirmed unauthorized access to its employee mobile groupware, a collaboration system using DaouOffice. According to News1, Bithumb is examining staff messages and shared files to determine whether customer information was included.
The company says the affected workplace network is physically separated from trading infrastructure and that no customer cryptocurrency was stolen. That assurance does not resolve the privacy investigation. CoinScreamer’s Bithumb coverage explains the distinction between a confirmed intrusion and an unconfirmed customer-data leak.
Daishin: 38,490 Customers and Eight Data Categories
Daishin Securities confirmed the exposure of personal information belonging to 38,490 customers, The Herald Business reported. The fields included names, email and physical addresses, communications IDs, bank names, bank account numbers, Daishin account numbers and mobile numbers.
The bank account numbers, Daishin account numbers and mobile numbers were encrypted, according to the company’s account. Their inclusion should not be described as proof that attackers obtained readable copies of every field.
Suspicious access was detected on October 17 on a server supporting online account opening for discretionary investment services. A subsequent investigation confirmed the leak on October 26. Daishin said it had found no unauthorized entry into core business systems or evidence of resulting secondary customer losses at the time of its disclosure.
Mirae Asset: Internal Business Data, Not Investor Records
Mirae Asset Global Investments confirmed unauthorized access to information in some web-based business systems. In comments reported by DigitalToday, it said the affected systems did not serve individual customers and ordinary investors’ information was not included.
The company said sensitive identifying and personal credit information was not exposed, and reported no financial losses or interruption to its main services. It blocked access routes and is investigating with outside security specialists. This is the asset manager’s disclosure, separate from the incident at affiliate Mirae Asset Life Insurance.
CZ’s Checklist for Exchange Accounts
Zhao’s recommendations focus on limiting the usefulness of leaked records and making accounts harder to take over:
- Use a different email alias for each exchange, share only required profile details and consider a dedicated phone number where supported.
- Use long, unique passwords and hardware security keys or passkeys; use an authenticator app if those options are unavailable, rather than SMS codes.
- Enable approved withdrawal addresses, withdrawal delays and an anti-phishing email code where the platform offers them.
- Ask the mobile carrier for a port-out PIN or number-transfer lock to reduce SIM-swap risk.
- Regularly review sessions and API keys, delete unused keys and restrict necessary keys by IP address with withdrawals disabled.
- After a breach announcement, change affected or reused passwords, revoke sessions and API keys, and review withdrawals and security settings.
These controls reduce particular risks; they cannot erase records already copied by an attacker. The checklist builds on themes in CZ’s earlier security guide.
Watch for the Follow-Up Scam
A caller knowing a customer’s name or purchase history is not proof of authenticity. Reach support independently through the official app or website, and never supply passwords, authentication codes or wallet recovery words to someone claiming to investigate a leak.
Our Keystone report examined support-impersonation risks after store records were exposed. Separate Ledger phishing coverage showed how a real security scare can become bait for a fake update. Neither case establishes a connection to the four latest disclosures.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
