On October 30, 2026 an unknown attacker gained unauthorized access to part of Coinmate's systems and downloaded users' personal data. Coinmate, a Czech exchange based in Prague, says it blocked the access as soon as it was detected and removed the vulnerability. It reported the incident to the Czech National Bank (its supervisor) and the Office for Personal Data Protection, and filed a criminal complaint. Affected users received an email from CEO Roman Valihrach on November 3. Coinmate has not published how the attacker got in.
| Leaked | Not leaked (per Coinmate) |
|---|---|
| Name, gender | Email, password, 2FA, API keys |
| Date and place of birth, citizenship | ID documents, Czech birth number |
| Home address, phone number | Bank accounts, wallet addresses, balances |
The exact set differs per person, depending on what each user gave the exchange. Coinmate says it reviewed all withdrawals, trades and account changes and found nothing wrong; trading and withdrawals run normally and you do not need to change your settings.
The danger is not your balance today but the next phone call. Someone who knows your name, address and birth date can sound exactly like exchange support. This is how losses usually follow a data leak; the same pattern followed the Ledger and Coinbase customer-data leaks.
Leaked names, birth dates and home addresses raise a fair question: could someone show up at the door? It has happened. After Ledger's customer data leaked in 2020, some customers received threatening letters, and France has seen a series of kidnappings and extortion attempts against crypto holders since 2025. The risk for an ordinary Coinmate user is still low: the leak shows only that you have an account, not how much you hold, and about 123,000 people are in the same list. Physical attacks have mostly targeted people who were publicly known to hold large amounts.
Handled this way, the risk is a reason to store crypto well, not a reason to avoid it.
Exchanges are generally safe, and both Binance and Coinmate protected customer funds. But the number of incidents is rising, and nothing guarantees that a future attack will not take down an exchange completely. That is why, more than ever, I recommend keeping long-term crypto savings in a personal wallet that only you control, and using exchanges only for buying and trading. My two picks are Tangem (a card you tap on your phone, readers get 10% off with code HCI) and Trezor (open-source, Safe 3 from $79).
Affiliate links. Buy only from the official store, never from marketplaces or resellers, and check the device before setup.A second verification layer on all access paths, more automated security testing, a new security audit firm and a published summary of the new audit. Those are the right steps; we will check whether the audit summary appears.
Disclosure first: Coinmate is our affiliate partner and I hold an account there. The response so far is open and quick: affected users got a specific list of their exposed data within four days, with regulators and police informed. Funds were not touched. But for a Czech exchange whose users are mostly Czech, leaked names, addresses and phone numbers mean months of targeted fraud attempts. Tell older family members who use Coinmate, because they are the usual targets.
Read our Coinmate review →No. Coinmate says the leaked data cannot be used to log in, withdraw or transfer funds, and that it checked all withdrawals, trades and account changes and found everything in order. Trading and withdrawals work normally.
First and last name, gender, date and place of birth, citizenship, home address and phone number. According to Coinmate, emails, passwords, two-factor data, API keys, ID documents, Czech birth numbers, bank account numbers, wallet addresses and account balances did not leak.
Czech media citing Coinmate report about 123,000 users. Coinmate emailed affected users on November 3, 2026, listing which of their data was exposed.
Expect convincing scam calls and messages that use your real name, address or birth date. Coinmate will never ask by phone, SMS or email for your password, 2FA code, seed phrase or a transfer, or ask you to install remote-access apps such as AnyDesk. Hang up and verify through [email protected], type coinmate.io by hand, and turn on two-factor authentication.
Customer funds were not affected and Coinmate reported the incident to the Czech National Bank, the data protection office and the police. Personal data exposure is still a real risk: the leaked details make phishing more believable for months. Coinmate says it will add a second verification layer to all access paths, change its security audit firm and publish the new audit's summary.
It is possible but unlikely for an ordinary user. The leak includes names and home addresses but not balances, and about 123,000 people are affected. Physical extortion of crypto holders, as seen in France since 2025, has mostly targeted people publicly known to hold large amounts. Don't talk about your holdings, keep larger amounts in multisig or a passphrase-protected hidden wallet, and agree with your family not to share anything with callers or unexpected visitors.
Join The Crypto Edge — our free weekly briefing for sober crypto investors. New subscribers get our DCA ebook. No spam, no hype.
Subscribe free →HomeCryptoInvest is independent — no sponsored rankings, written by an investor who uses his own money. If our coverage saved you time, you can buy us a coffee.
Buy me a coffee →