Japanese crypto exchange Zaif suffers leak of 380,000 custom
Japanese crypto exchange Zaif announced on November 4 that its third-party email service provider Arara suffered unauthorized access, resulting in the leakage of customer email addresses. Wu said the number was 380,536, while PANews said approximately 380,000 (after deduplication). Zaif stated that the leaked data was limited to email addresses and did not include names, transaction records, or passwords; during the suspension of Arara's services, Zaif has stopped sending emails and advised customers to be vigilant against phishing emails.
Event Timeline
- [11-05 01:57] Japanese crypto exchange Zaif suffered a breach at a third-party service provider, leaking 380,000 customer email addresses (Wu said)
- [11-05 02:01] Japanese crypto exchange Zaif suffered a breach at a third-party service provider, leaking approximately 380,000 customer email addresses (PANews)
Background and Impact
Japanese crypto exchange Zaif announced on November 4 that its third-party email service provider Arara had suffered unauthorized access, resulting in the leakage of customer email addresses. The timeline is as follows: Zaif first disclosed the potential leakage risk on November 2, then received confirmation from the service provider, and on November 4 obtained the list of affected email addresses and made it public the same day. Related reports were published by Wu said and PANews on November 5.
Regarding the scale of impact, the two sources differ in their statements. Wu said gave the figure of 380,536 customer email addresses; PANews stated approximately 380,000 customer email addresses and noted that this was the number after deduplication. Zaif explained that the data provided to the service provider included only email addresses and did not involve customer names, addresses, transaction records, or passwords; no unauthorized access to Zaif's own systems has been found so far, accounts cannot be logged into with email addresses alone, and no secondary harm such as asset damage has been confirmed.
Due to the suspension of Arara's services, Zaif has suspended email sending. The exchange reminded customers to be vigilant against phishing emails impersonating Zaif or Arara, not to click links in emails or enter authentication information, and recommended switching to authentication apps for two-factor verification.
From the perspective of impact, the core risk of this incident is not the account assets themselves, but the use of email addresses for targeted phishing. The leak occurred at the third-party service provider, not in the exchange's own systems; this means that the permission boundaries of outsourced services and the security capabilities of suppliers are also part of an exchange's risk. For users, before Arara's services are restored and Zaif's email channel is restarted, any email claiming to be from Zaif or Arara and asking users to click links or submit authentication information should be regarded as suspicious. Whether for routine login or when searching online for information such as Huobi invitation codes, Gate.io account opening discounts, Bitget account opening discounts, Binance registration offers, or OKX registration offers, verifying the domain and source and not entering accounts through email links are safer practices. As of the time of reporting, neither Zaif nor Arara had announced a further processing timetable.
FAQ
### What data was involved in this leak, and will it affect account funds?
According to Zaif, the leaked data was limited to email addresses and did not include names, addresses, transaction records, or passwords; accounts cannot be logged into with email alone, no secondary harm such as asset damage has been confirmed so far, and no intrusion into Zaif's own systems has been found.
### What should I do if I receive an email suspected to be from Zaif or Arara?
Zaif has reminded customers to be vigilant against phishing emails impersonating it or Arara, not to click links or enter authentication information, and recommended switching to authentication apps for two-factor verification. Before email services are restored, any email requesting authentication information should be regarded as suspicious.
### What points should be monitored going forward?
First, when Arara's suspended services will be restored and when Zaif will restart email sending; second, whether Zaif and Arara will publish further investigation results or a processing timetable. As of the time of reporting, neither party had given a clear schedule.