Last updated: October 29, 2026
On October 27–28, 2026, two major crypto exchanges reported data leaks: Bithumb, after hackers broke into an employee collaboration system, and Coinbase, after its analytics vendor Amplitude exposed contact details of a small group of users. Neither exchange reports stolen crypto. But both incidents follow the same pattern as most exchange leaks: the data escaped through a side door — a vendor or an internal tool — not the trading system. Your KYC data is only as safe as the weakest company that touches it. Below: what happened, what to do if you're a customer, and how to keep less of your identity on exchanges.
- 2 exchange leaks in 2 days
- 38,490 clients of a Korean broker hit the same week
- 69,461 people in Coinbase's 2025 breach
- 0 crypto stolen, per both exchanges
What happened at Bithumb
South Korean exchange Bithumb found unauthorized access to its corporate mobile system on October 27, 2026 and reported it to the regulators KISA and PIPC the same day. The attackers got into DaouOffice, a collaboration platform staff use for messages and file sharing. According to Korean media, employee names, departments and contacts were likely taken; Bithumb is checking whether customer information sat in files shared inside the system.
Bithumb says this system is physically separated from its trading infrastructure, so customer funds can't be reached through it. It hasn't said how many people are affected or how the attackers got in. The incident came amid a wave of attacks on Korean financial firms: the same week, broker Daishin Securities confirmed that names, contacts and addresses of 38,490 clients were compromised. In June, Bithumb was ordered by the privacy regulator PIPC to pay 210 million won for transferring user data to overseas companies without consent.
What happened at Coinbase
Coinbase says its own systems were not breached. The leak came from Amplitude, a third-party product-analytics company that Coinbase and many other firms use. Contact information of a small subset of Coinbase users was exposed, along with data of other Amplitude customers. Coinbase hasn't published how many users are affected and is notifying them by email, as the law requires.
It is Coinbase's second vendor-linked incident in under two years. In May 2025 it disclosed that overseas support contractors had been bribed to pass customer data to criminals. That breach affected 69,461 people and included names, addresses, phone numbers, emails, masked Social Security and bank numbers, and government ID images. Coinbase refused a $20 million extortion demand.
The pattern: leaks come through side doors
| Incident | Entry point | Data exposed |
|---|---|---|
| Bithumb, Oct 2026 | Employee collaboration platform | Staff contacts; customer data in shared files under review |
| Coinbase, Oct 2026 | Analytics vendor (Amplitude) | Contact information of a small subset of users |
| Coinbase, 2025 | Bribed support contractors | Names, addresses, ID images, masked SSN and bank data |
| Ledger, 2020 | E-commerce and marketing database | About 1 million emails; 272,000 names, addresses and phone numbers |
Every company that verifies, supports, analyses or emails you adds a copy of your data and a new way for it to leak. Exchanges can harden their core systems, but they can't fully control dozens of vendors and thousands of staff accounts. And unlike a password, your passport, face and home address can't be changed after a leak.
Why a KYC leak is worse than a password leak
- Targeted phishing: scammers know your name, exchange and sometimes balance, so fake "security team" calls sound real — see crypto phishing emails and SMS.
- SIM swaps: a leaked phone number plus personal details is what attackers need to hijack your number — SIM swap attacks.
- Physical risk: a home address linked to crypto holdings can lead to wrench attacks.
- Permanent exposure: leaked datasets get copied, resold and merged with other leaks for years.
If you use Bithumb or Coinbase: what to do now
- Trust no inbound contact. Exchanges never ask for your seed phrase or ask you to move funds to a "safe wallet". Hang up, and log in only by typing the official address.
- Use an authenticator app or a security key instead of SMS codes — crypto 2FA guide.
- Secure the email account linked to the exchange: new unique password and 2FA.
- Keep only what you trade on the exchange. Move the rest to a wallet you control — not your keys, not your coins.
- Follow the full checklist in what to do after an exchange data breach, and consider requesting deletion of your KYC data from exchanges you no longer use.
How to keep less of your identity on exchanges
You can't un-leak data, but you can stop creating more copies. Instant swap services that need no account, email or ID hold far less about you: there is no profile to leak, only the order itself. Use them for swaps that don't need a bank connection, and pick ones that don't log IPs — compare them on the no-logs list and check real user reports on the no-KYC track record. To move coins off a verified exchange without adding a new data trail, see how to move crypto off a KYC exchange privately.
Frequently asked questions
Was crypto stolen in the Bithumb or Coinbase leaks?
No. Both exchanges say no customer funds were taken. Bithumb says the hacked system is separated from trading infrastructure, and Coinbase says its own systems were not breached.
What Coinbase data leaked through Amplitude?
Contact information of a small subset of users, according to Coinbase. It hasn't published the number of people affected and is notifying them by email.
How did hackers get into Bithumb?
Through DaouOffice, a collaboration platform employees use for messages and file sharing. Bithumb hasn't disclosed how the attackers gained access.
I got an email about the leak — is it real?
Maybe, but don't click links in it. Log in by typing the exchange's address yourself and check notifications there. Leak news is always followed by fake "breach" emails asking you to verify your account.
Do no-KYC exchanges leak data too?
They can — the Wagyu leak in October 2026 exposed order records and IPs. But without IDs, selfies and home addresses, a leak exposes far less. Choose services with a no-logs policy and use Tor or a VPN.
Every account is one more copy of your identity. For swaps, skip the account: compare offers on /swap — for example BTC → XMR or USDT → BTC. No account, no ID, no logs. Related: the Wagyu swap data leak.
Sources: ForkLog, CoinDesk, Security Affairs (2025 breach).