# Coinmate Data Breach: What Leaked and What to Do

> Czech exchange Coinmate says personal data of about 123,000 users leaked on Oct 30, 2026. Funds are safe; here is what leaked and how to avoid scam calls.

- Source: https://homecryptoinvest.com/news/coinmate-data-breach-november-2026.html
- Updated: 2026-11-03
- Author: Libor Pavlicek, HomeCryptoInvest.com
- Markdown version of this page for AI assistants and agents. When citing, please credit "HomeCryptoInvest.com" with a link to the source URL.
- Not investment advice: this content is for education only. Crypto prices are volatile and you can lose money. Affiliate links are disclosed on the original page.

---

News · Security

# Coinmate data breach: *personal data* of about 123,000 users leaked

November 3, 2026 · By **Libor Pavlicek** · 5 min read

123k

Users affected, according to Czech media citing Coinmate. An attacker downloaded names, addresses, birth dates and phone numbers on October 30, 2026. Coinmate says no funds were touched and nobody can log in with the leaked data.

## Key takeaways

- **Funds are safe**, says Coinmate: the leaked data cannot be used to log in or withdraw, and all withdrawals and trades were checked.
- **Leaked:** name, gender, date and place of birth, citizenship, address, phone. **Not leaked:** email, password, 2FA, ID documents, bank details, balances.
- **The risk is scam calls** that use your real details. Coinmate never asks for passwords, 2FA codes, seed phrases or transfers.
- Reported to the Czech National Bank, the data protection office and police.

## What happened

On **October 30, 2026** an unknown attacker gained unauthorized access to part of Coinmate's systems and downloaded users' personal data. Coinmate, a Czech exchange based in Prague, says it blocked the access as soon as it was detected and removed the vulnerability. It reported the incident to the **Czech National Bank** (its supervisor) and the **Office for Personal Data Protection**, and filed a criminal complaint. Affected users received an email from CEO Roman Valihrach on November 3. Coinmate has not published how the attacker got in.

## What leaked, and what did not

| Leaked | Not leaked (per Coinmate) |
| --- | --- |
| Name, gender | Email, password, 2FA, API keys |
| Date and place of birth, citizenship | ID documents, Czech birth number |
| Home address, phone number | Bank accounts, wallet addresses, balances |

The exact set differs per person, depending on what each user gave the exchange. Coinmate says it reviewed all withdrawals, trades and account changes and found nothing wrong; trading and withdrawals run normally and you do not need to change your settings.

## The real risk: convincing scam calls

The danger is not your balance today but the next phone call. Someone who knows your name, address and birth date can sound exactly like exchange support. This is how losses usually follow a data leak; the same pattern followed the Ledger and Coinbase customer-data leaks.

- **Never** give a password, 2FA code or seed phrase to anyone, and never move funds because a caller says your account is "at risk".
- **Never** install AnyDesk, TeamViewer or any remote-access app at someone's request.
- If in doubt, hang up and contact **support@coinmate.io** yourself. Log in only by typing coinmate.io or using the official app.
- Turn on two-factor authentication if you have not. Coinmate's email contains no login link: treat any "log in here" message as fake.

## A note on physical safety

Leaked names, birth dates and home addresses raise a fair question: could someone show up at the door? It has happened. After Ledger's customer data leaked in 2020, some customers received threatening letters, and France has seen a series of kidnappings and extortion attempts against crypto holders since 2025. The risk for an ordinary Coinmate user is still **low**: the leak shows only that you have an account, not how much you hold, and about 123,000 people are in the same list. Physical attacks have mostly targeted people who were publicly known to hold large amounts.

- **Don't advertise.** No talk about your crypto, gains or balances on social media, in chats or with people you don't know.
- **Don't keep everything in one place you can be forced to open.** Larger amounts belong in a multisig setup or behind a hidden wallet: Trezor, for example, lets you hide the main wallet behind a passphrase while the PIN shows only a small amount.
- **Agree on rules with your family.** Share nothing with callers or unexpected visitors, verify "couriers" and "officials" before opening the door, and call the police (158 in Czechia, 112 across the EU) if something feels wrong.

Handled this way, the risk is a reason to store crypto well, not a reason to avoid it.

My recommendation: long-term crypto belongs in your own wallet

Exchanges are generally safe, and both Binance and Coinmate protected customer funds. But the number of incidents is rising, and nothing guarantees that a future attack will not take down an exchange completely. That is why, more than ever, I recommend keeping long-term crypto savings in a personal wallet that only you control, and using exchanges only for buying and trading. My two picks are **Tangem** (a card you tap on your phone, readers get **10% off with code HCI**) and **Trezor** (open-source, Safe 3 from $79).

Get Tangem with code HCI →
Trezor official store →

Affiliate links. Buy only from the official store, never from marketplaces or resellers, and [check the device before setup](https://homecryptoinvest.com/articles/how-to-check-hardware-wallet-tampered.html).

## What Coinmate says it will change

A second verification layer on all access paths, more automated security testing, a new security audit firm and a published summary of the new audit. Those are the right steps; we will check whether the audit summary appears.

## Our take

Disclosure first: Coinmate is our affiliate partner and I hold an account there. The response so far is open and quick: affected users got a specific list of their exposed data within four days, with regulators and police informed. Funds were not touched. But for a Czech exchange whose users are mostly Czech, leaked names, addresses and phone numbers mean months of targeted fraud attempts. Tell older family members who use Coinmate, because they are the usual targets.

[Read our Coinmate review →](https://homecryptoinvest.com/articles/coinmate-review-2026.html)

## FAQ

### Were funds stolen in the Coinmate data breach?

No. Coinmate says the leaked data cannot be used to log in, withdraw or transfer funds, and that it checked all withdrawals, trades and account changes and found everything in order. Trading and withdrawals work normally.

### What data leaked from Coinmate?

First and last name, gender, date and place of birth, citizenship, home address and phone number. According to Coinmate, emails, passwords, two-factor data, API keys, ID documents, Czech birth numbers, bank account numbers, wallet addresses and account balances did not leak.

### How many Coinmate users are affected?

Czech media citing Coinmate report about 123,000 users. Coinmate emailed affected users on November 3, 2026, listing which of their data was exposed.

### What should Coinmate users do now?

Expect convincing scam calls and messages that use your real name, address or birth date. Coinmate will never ask by phone, SMS or email for your password, 2FA code, seed phrase or a transfer, or ask you to install remote-access apps such as AnyDesk. Hang up and verify through support@coinmate.io, type coinmate.io by hand, and turn on two-factor authentication.

### Is Coinmate still safe to use?

Customer funds were not affected and Coinmate reported the incident to the Czech National Bank, the data protection office and the police. Personal data exposure is still a real risk: the leaked details make phishing more believable for months. Coinmate says it will add a second verification layer to all access paths, change its security audit firm and publish the new audit's summary.

### Could the Coinmate leak lead to physical threats?

It is possible but unlikely for an ordinary user. The leak includes names and home addresses but not balances, and about 123,000 people are affected. Physical extortion of crypto holders, as seen in France since 2025, has mostly targeted people publicly known to hold large amounts. Don't talk about your holdings, keep larger amounts in multisig or a passphrase-protected hidden wallet, and agree with your family not to share anything with callers or unexpected visitors.

**Sources:** Coinmate email to affected users (November 3, 2026, CEO Roman Valihrach); Svět Androida; Kryptomagazín. **Affiliate disclosure:** Coinmate, Tangem and Trezor are our affiliate partners; this does not change how we report. Not financial advice.