Four data breaches landed in a single day on October 28, hitting two cryptocurrency platforms and two South Korean financial firms at once. Binance founder Changpeng Zhao flagged all four in a post on X, warning that leaked exchange data “is mostly used for phishing, SIM swapping, and social engineering.” The first involved Amplitude, a third-party analytics vendor used by Coinbase, which exposed some users’ contact information. Coinbase denied the breach was its own, attributing the incident entirely to Amplitude and confirming customer funds were unaffected.
In South Korea, the crypto exchange Bithumb reported a leak after attackers hacked an internal messaging app used by its employees. The breach exposed employee names and phone numbers, and the company is still investigating whether the hackers also accessed customer data. The breach is the latest in a difficult year for Bithumb, which has faced repeated security setbacks through 2026.
This wave of security failures also hit traditional finance directly. Daishin Securities confirmed that hackers accessed the personal information of 38,490 customers, exposing names, email addresses, and mobile phone numbers, after the firm detected signs of unauthorized access the previous week. Mirae Asset Global Investments separately confirmed a hacking incident the same day, though the firm said the breach exposed only some employee names rather than customer data. South Korean financial regulators have opened an inspection into both incidents.
4 data leaks reported today:
1. Coinbase’s vendor Amplitude exposed some users’ contact data (funds unaffected).
2. Bithumb (Korea) had user data leaks.In TradFi, two securities firms in Korea leaked data:
3. Mirae Asset
4. Daishin SecuritiesYou can’t prevent a leak, but you can protect yourself.
Leaked exchange data (names, emails, phone numbers, addresses, ID documents, transaction history) is mostly used for phishing, SIM swapping, and social engineering.
Reduce info you share
– Use a unique email alias for each exchange (SimpleLogin, Apple Hide My Email, etc). A leak then can’t be linked to your other accounts, and you can spot which service leaked.
– Share only what’s required. Don’t add optional profile details.
– Use a dedicated phone number (a VoIP or secondary SIM) for exchange accounts if you can, since leaked numbers are the main route to SIM swaps.Lock down the account
– Use a unique, long password from a password manager.
– Turn on hardware security keys (YubiKey) or passkeys, or at least an authenticator app.
– Avoid SMS 2FA.
– Enable withdrawal address whitelisting and a withdrawal time lock if the exchange offers them.
– Set up an anti-phishing code, which puts a code you choose in every legitimate email from the exchange.
– Review active sessions and API keys regularly. Delete any API keys you don’t use.
– Restrict API keys to withdraw-disabled and IP-whitelisted.Defend against
– SIM swapping: Ask your carrier to add a port-out PIN or number lock.
– Phishing and impersonation: Assume anyone who contacts you about your account, “security issues,” or “refund recovery” is a scammer, even if they know your name, balance, or recent trades.
– Exchange support staff don’t ask for your password, 2FA codes, or seed phrase.
– Never click links in emails or texts. Go to the site yourself.– “Wrench attacks”: Leaked addresses plus holdings data have led to real-world extortion and robberies. Don’t publicize your holdings, and keep large balances out of anything tied to your home address if you can.
If a breach is announced
1. Change the exchange password and any other account that reused it.
2. Check https://t.co/qtIGFkbaPO for your email address.
3. Revoke API keys and active sessions.
4. Review recent withdrawals and security settings.
5. Watch for phishing emails and texts that reference the breach, because scammers move fast after one.Stay SAFU! 🙏
— CZ 🔶 BNB (@cz_binance) October 28, 2026
Zhao published a full list of account protections in the same post. He said users should create a unique email alias for every exchange account, replace SMS login codes with hardware security keys or passkeys, and restrict withdrawals to pre-approved addresses with time locks attached. He also recommended setting an anti-phishing code, regularly auditing active sessions and API key permissions, and contacting mobile carriers directly to request a port-out lock, which prevents a phone number from being transferred without additional verification. Zhao added that leaked addresses and holdings data “have led to real-world extortion and robberies,” and said users should avoid publicly disclosing their holdings or linking large balances to a home address.
Traders immediately reacted to the ongoing security failures. User @cryptoDaFa said they had been receiving frequent phishing emails and regretted not using separate email addresses for each exchange or app, making it difficult to identify the source of the problem.
@cz_binance 最近老是收到钓鱼邮件，后悔了没有每个交易所或者APP用唯一一个邮箱地址，现在不知道问题出在哪里
— DaFa🎒 (@cryptoDaFa) October 28, 2026
User Tuku emphasized that using a unique email alias for each exchange helps identify which platform was responsible for a leak.
@cz_binance email alias per exchange is so slept on. one leak and you know exactly who leaked it
— ~ Tuku🧸 (@Mewow_be) October 28, 2026
Meanwhile, user @favezy noted that Binance appeared untouched by the latest wave of incidents, though the platform has had its own security history, including a 2019 breach that exposed API keys and two-factor codes.
@cz_binance But how come these leaks only seem to happen with other exchanges?
At this point, Binance feels like the only safe place.
— Dr. Favezy (@favezy) October 28, 2026
READ ALSO: CZ Says Banks Use Weaker Encryption Than Bitcoin, Warns of AI Crypto Scams
How SIM-swapping attacks can drain your crypto account
When a cryptocurrency exchange leaks your phone number, criminals use it to bypass your digital security completely. They execute a SIM swap. A hacker finds your phone number in a leaked database. They call your mobile carrier, such as T-Mobile or Verizon, and pretend to be you. They use other leaked information, like your date of birth or billing address, to trick the customer service agent over the phone.
The hacker asks the agent to transfer your phone service to a new SIM card that the hacker physically holds in their hand. The moment the agent hits accept, the signal drops on your real phone. Your screen says “No Service.” The hacker’s phone now receives all of your incoming text messages and phone calls.
Next, the hacker goes to the crypto exchange website and clicks “forgot password.” The exchange sends a security code via text message. The hacker receives that text message, types in the code, creates a new password, and drains your account.
To stop this, you must remove your daily cell phone number from all financial accounts. Go into your exchange settings and delete the phone number. Replace it with a physical security device, like a YubiKey. A YubiKey requires you to physically press a piece of plastic plugged into your computer to log in. A hacker in another country cannot press it. If an exchange forces you to use a phone number, use a Voice over IP (VoIP) number. A VoIP number is an internet phone number, like Google Voice, attached to an email address. A hacker cannot call a cell phone store employee to steal a Google Voice number.
READ ALSO: Crypto Security Has Come a Long Way, So Have the People Trying to Break It
Crypto and regular stocks now share the same danger
In the past, regular stock brokers and crypto exchanges used completely different computers. If a crypto company got hacked, normal stock investors were safe. That safety wall is gone. Today, both crypto platforms like Coinbase and regular stock firms like Daishin use the exact same internet tools and outside companies to run their daily business.
Because they share the same tech, one hack hits both markets at once. When a shared system breaks, thieves do not just steal the emails of Bitcoin traders. They also steal the private bank account numbers of regular people saving for retirement. The danger is no longer isolated to the crypto world. It hurts everyone.
This shared risk forces governments to change how they protect money. Lawmakers can no longer treat crypto as a separate, small tech problem. Because a security failure in crypto software can now damage traditional banking customers, the government has to write one strict set of rules for everybody. Wall Street banks and crypto exchanges must now face the exact same security laws.
Leaked identity documents often lead to physical wrench attacks
A financial data breach often exposes the customers Know Your Customer (KYC) records, and they may get access to your home address.
This access often leads directly to physical crime, commonly known in the crypto industry as a “wrench attack.” When the hardware wallet company Ledger suffered a massive customer database leak in 2020, criminals used the stolen home addresses to send physical death threats to customers in the mail. Several victims faced actual home invasions from armed robbers who knew exactly how much crypto was in the house.
In another development, CZ said Hong Kong has strong potential to become an important Web3 hub because of its fintech talent, links to mainland China and access to institutional capital. Speaking at a Binance Life book meetup in Hong Kong, the Binance co-founder also pointed to Dubai, Abu Dhabi and the United States as markets he views positively as governments become more supportive of the crypto industry.
Frequently Asked Questions
Which companies were affected by the October 28 data leaks CZ flagged?
Four organizations were involved: Amplitude, a third-party analytics vendor used by Coinbase, South Korean crypto exchange Bithumb, and South Korean financial firms Daishin Securities and Mirae Asset Global Investments. Coinbase and Bithumb’s own systems were not the point of failure in either case.
Were any crypto funds stolen in these breaches?
No. Coinbase confirmed that customer funds were unaffected by the Amplitude incident, and none of the four breaches reported on October 28 involved direct theft of cryptocurrency, the exposure was limited to contact and personal information.
What is a SIM swap, and how does it connect to a data leak?
A SIM swap is when a hacker uses leaked personal details to convince a mobile carrier to transfer a victim’s phone number to a SIM card the hacker controls, which lets them intercept the login codes exchanges send by text message. A leaked phone number from an unrelated breach is often the starting point for this attack weeks or months later.
What is a wrench attack in crypto?
A wrench attack is a physical robbery or extortion attempt against a crypto holder, typically made possible when a data leak exposes someone’s home address alongside evidence of their crypto holdings. Wrench attacks tied to leaked address and holdings data netted criminals an estimated $30 million in thefts during the first half of 2026 alone.
What specific steps did CZ recommend after the leaks?
Zhao advised using a unique email alias per exchange, replacing SMS login codes with hardware security keys or passkeys, restricting withdrawals to pre-approved addresses with time locks, setting an anti-phishing code, auditing API key permissions regularly, and requesting a port-out lock directly from a mobile carrier to prevent unauthorized number transfers.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics.
