The Guy Who BUILT Coupang’s Login Security Stole the Master Key — 37M People Leaked
The Guy Who BUILT Coupang’s Login Security Stole the Master Key — 37M People LeakedNo genius hack. No zero-day. Just one dude who kept a copy of the key he made — then walked back in months later.
$409 million fine (biggest in South Korea’s history) → 33,222,472 members leaked → +4,338,368 people who never even had accounts → all from ONE stolen signing key.
Coupang is basically the Amazon of South Korea. And the country’s privacy regulator just said the leak didn’t come from some elite cyber-army — it came from “deficiencies in basic safety management.” Translation: they left the door open. Full story at The Record.
🧩 Dumb Mode Dictionary
| Term | What it actually means |
|---|---|
| Signing key | A secret master password that proves “yes, this login system is really me.” Whoever holds it can wave the guards through. |
| Insider threat | The danger isn’t a stranger outside — it’s someone who used to work there and still has the keys. |
| Authentication system | The bouncer at the door that checks “are you really you?” before letting you into your account. |
| PIPC | South Korea’s privacy police. They hand out the fines. Wiki here. |
| Offboarding | The checklist a company should run when you quit — kill your logins, take back your keys. Coupang skipped a big one. |
🕵️ How this actually went down (it's dumber than you think)
Here’s the play, step by step:
- A software engineer — a Chinese national — worked at Coupang and personally built their backup login system.
- Before he quit at the end of 2024, he quietly copied the signing key → the one master secret that whole system trusted.
- The breach happened in late June → but nobody at Coupang noticed until mid-November. That’s ~4 months of a wide-open barn.
- Because he made the lock himself, he knew exactly where every weak spot was. → No brute force needed.
Between you and me? This is the oldest trick in the book. The scariest hacker isn’t a stranger. It’s the person who built the wall and remembers where the loose brick is. More detail on BleepingComputer.
📊 The receipts (the numbers that matter)
| Thing | Number |
|---|---|
| Members leaked | 33,222,472 |
| Non-members leaked (people stored as delivery recipients!) | 4,338,368 |
| The fine | 624.7 billion won ≈ $409 million |
| Previous record fine (SK Telecom, earlier same year) | $88.8 million |
| Payout Coupang promised customers | ~$1.17 billion |
| Voucher per affected customer | 50,000 won ≈ $34 |
That non-member number is the sneaky part. → You never signed up for Coupang, but a friend shipped you a gift → your name, phone number, and home address got stored → and leaked. You got robbed by a store you never shopped at. Korea Times has the local angle.
🗣️ What the timeline's saying
- Security folks are basically screaming “THIS is why offboarding matters” into the void.
- The wild part everyone keeps repeating: the regulator said it wasn’t sophisticated hacking → it was basic stuff Coupang didn’t lock down.
- And that $34 voucher for having your home address leaked? People are… not thrilled. It’s like getting a coupon after someone reads your diary.
- Bigger picture: signing keys are the new crown jewels. If your company treats them like a sticky note, you’re one resignation away from the news. Good primer on secrets management from GitHub.
Cool. Some Guy Kept a Copy of the Master Key and Nuked 37 Million People… Now What the Hell Do We Do? (⊙_⊙)
Every panic is a market. When a $409M fine hits the front page, thousands of companies suddenly realize they have the same loose brick → and they’ll pay somebody to find it first. Here’s where the money’s hiding.
🕳️ The Ghost Key Hunter
Departing engineers leak secrets by accident all the time — pasted into public code, old repos, forgotten config files. There are FREE tools that scan the internet for exactly these leaked keys. You run the scan → you find the exposed key → you politely email the small company that owns it before a bad guy does.
Example: A 23-year-old in Lagos runs TruffleHog (free, open-source) against public code repos every night, filters for leaked signing/API keys tied to small e-commerce shops, and sends a one-line “hey, this is exposed, I can help you rotate it” email. Charges a flat $150 finder’s fee + $200 to help fix it. 6 clients in month one → $2,100.
Timeline: First responses in ~2 weeks (most people ignore cold emails — volume is the game). Plateaus once the easy public leaks in your niche dry up (~3-4 months) — then you pivot to a paid monitoring retainer.
📋 The Offboarding Snitch List
Coupang’s whole $409M nightmare = they didn’t take back one guy’s key when he quit. Tiny companies have ZERO system for this. Here’s what you do: build a dead-simple “when someone quits, kill THESE 20 things” checklist as a paid template, tuned per industry.
Example: A 27-year-old ops person in Manila packages a Notion + Google Sheet “Offboarding Kill-Switch Kit” (revoke keys, transfer 2FA, audit shared logins) and sells it on Gumroad for $29. Posts one breakdown of the Coupang story in HR + startup subreddits → 340 sales in 6 weeks → ~$9,800. No code, no meetings.
🎟️ The Voucher Whisperer
33 million confused people just got told they’re owed a $34 voucher and $1B+ in payouts — and most have NO idea how to actually claim it or what their rights are. The first clear, dead-simple “how to claim your money + protect yourself” guide becomes the thing everyone links to. Be the dictionary.
Example: A 25-year-old in Seoul writes one clean Korean-language “Am I affected? Here’s exactly how to claim your Coupang compensation” page, ranks it on Google/Naver for the breach terms, and monetizes with a free password-manager + credit-monitoring affiliate link at the bottom (like Bitwarden). 40,000 visitors in the first month → a few hundred signups → steady side income.
📡 The Breach-Signal Reseller
Reverse the data flow. Public breach databases already exist for free. But small local businesses in one country/language have no easy way to check if THEIR customer emails are in a fresh dump. Bridge that gap → charge a tiny monthly fee for “we’ll warn you if your customer list shows up in a leak.”
Example: A 24-year-old in Jakarta builds a bare-bones checker on top of the free Have I Been Pwned API, wraps it in a simple dashboard for local online sellers, and charges $9/month per shop to auto-alert them. 60 shops → $540/month recurring, mostly hands-off after setup.
🔑 Sell the Shovels, Not the Gold
Everyone’s freaking out about insider key theft → but almost nobody wants to learn how to rotate secrets properly. So sell them the boring pre-made tool. Package ready-to-run scripts + a step-by-step “rotate every key in 1 hour” playbook. Picks-and-shovels always outlast the hype.
Example: A 29-year-old dev in Kraków bundles ready-made key-rotation scripts (built around free tools like HashiCorp Vault and git-secrets) into a $49 “Insider-Proof Starter Pack” on Gumroad, plus a 20-min setup video. Shares it in dev communities right as the Coupang fine trends → 180 sales → ~$8,800, and it keeps selling on autopilot.
🛠️ Follow-Up Actions
| If you want to… | Do this |
|---|---|
| Hunt exposed keys | Run TruffleHog on public repos |
| Sell a template | Ship it on Gumroad — zero code needed |
| Check breach exposure | Use the HIBP API |
| Understand the fine | Read The Record’s report |
| Lock down your own keys | Start with git-secrets |
Quick Hits
| You want… | Here’s the move |
|---|---|
 To find leaked keys before the bad guys |
Scan public code with TruffleHog |
 A no-code product to sell today |
Package an offboarding checklist |
 To protect your own accounts |
Grab a free password manager + turn on 2FA |
 The full story |
The Record / BleepingComputer |
| To learn insider-threat basics |
Read up on secret scanning |
The strongest lock in the world means nothing if the locksmith keeps a copy of the key. Check who’s still holding yours.
!