Last week the industry told customers to take what was left and go. This week it published the post-mortems, and they were mostly about where the spare keys had been kept.

Last Sunday I wrote about remaining funds: wallets emptied by rescuers, accounts closing on a deadline, an exchange frozen by one email.¹ The question at the end was whether the door still opened.

This week we found out how several doors had been opened in the first place. Nobody picked a lock. The keys were on paper, in a log file, in a cloud account, under a default password, or in a support chat that someone else was paid to keep.

I have read five post-mortems and incident notices since Monday. The phrase that kept coming back to me was not “sophisticated attacker”. It was “was meant to”.

The log line was meant never to run in production. The firewall rule was meant to stay. The test server was meant to be a test.

On paper, eight years ago

Start with the most old-fashioned one, because it is the most human.

Unocoin, an Indian exchange, used a wallet set up so that any two of three keys could approve a transfer. BitGo held one key. Unocoin held the other two: a user key and a backup key.²

On Friday BitGo said the transfers out of a wallet Unocoin had asked it to freeze were signed with those two Unocoin keys, and sent straight to the blockchain without BitGo. Its own key, it said, “was never used”.³ A freeze at a custodian means the custodian stops signing. It does not stop anyone who already holds enough keys.

On Saturday Unocoin put a number on it: about $200,000 from three of its more than 20 hot wallets, which it says it will cover itself.⁴ It said the backup keys had been generated about eight years ago, encrypted, printed on paper and kept in secure physical storage. The passphrase that decrypts them, it said, existed in its compromised infrastructure, although that “is not fully solving the puzzle”.⁵

I do not want to be glib about paper. Printing a backup key and locking it away is standard advice, and a perfectly good idea until the thing that unlocks it lives somewhere else, on a server, for eight years.

The backup is supposed to be the key you never need. It turns out to be the one nobody checks.

In the logs, and on default

Proxima, a Solana trading app, published the week’s most candid post-mortem late on Saturday.⁶

It says a debug-level log line, added during development for private-beta features, wrote wallet private keys into its diagnostic logs. The line was meant never to run in production. It did, once the production log level was lowered from info to debug to monitor performance. Those logs sat for 15 days in a SigNoz monitoring instance that an outside consultant had set up months earlier, with a known vulnerability and an upgrade that had been “repeatedly postponed”. Then a firewall rule meant to keep it private “was inadvertently removed”.

The result, by Proxima’s count: 5,324.2 SOL from 870 wallets belonging to 181 users on 14 Nov, which at Kraken’s SOL price was near $400,000. It says everyone has been refunded.⁷

Proxima’s account is the only one we have. It is also unusually honest. Three ordinary decisions, each defensible on the day, stacked into a hole.

Chainstack, which runs blockchain nodes for developers, needed only one. It says an attacker entered its development environment in late October through a test Grafana dashboard, open to the internet, whose default administrator login had never been changed. From there, the attacker reached a database of customer account data and systems that store customers’ node credentials.⁸

Chainstack says it has no evidence the credentials were read and is treating them as exposed anyway. Customers have been told to change passwords, rotate node credentials and regenerate API keys.

“No exploit was needed” is how our security desk began that alert.⁹ It is the most expensive sentence in the trade, and it costs nothing to write.

In someone else’s cloud, and someone else’s call centre

Initia’s keys were not on paper. They were in the cloud.

The chain halted its layer 1 on Tuesday, its second halt in under three weeks.¹⁰ In a fuller update it said the breach began with a command-injection attack on 9 Nov that used a compromised Google Cloud key for provisioning private nodes. That exposed credentials for its GitHub and cloud accounts, and then for Anvil, the platform its rollups run on. From there, forged withdrawals were validated on five rollups.

About $3.27 million of assets moved to the attacker’s address, Initia says, and about $2.16 million of that is still sitting on the paused chain, where it cannot be moved.¹¹ It says it intends to restore the backing of the affected assets in full. As of Saturday the chain was still halted, with no restart date.¹²

Coinone’s problem is the newest and, in a way, the most modern. Nothing was stolen from its wallets, it says. An attacker got into the servers of MetaM, the company Coinone pays to answer its customers, at about 04:00 Korea time on 12 Nov.¹³

What sat on those servers was whatever customers had told the support desk. Coinone lists 11 kinds of information, including passwords, bank account numbers and resident registration numbers, South Korea’s national identity number. It does not say how many people are affected. Customers who never contacted support are not.

There is a lesson in this that no exchange will put in its marketing. “Never share your password with anyone, including us” is printed on almost every login page. Some customers, it appears, shared it with the support desk anyway, and the support desk belonged to someone else.

I am not blaming them. If the person on the other end of the chat says they need it to fix your account, you give it. The spare key in this case was the customer’s own, handed over in good faith and stored by a contractor.

Incident ledger

  • Initia · compromised cloud key led to forged withdrawals from five rollups; about $3.27M moved, about $2.16M stuck on the halted chain, Initia says. Initia’s second halt.
  • Proxima · private keys in debug logs exposed through an unpatched monitoring tool; 5,324.2 SOL from 181 users (near $400,000 at Kraken’s price); refunds made, it says. the post-mortem.
  • Unocoin · its own user and backup keys signed transfers from a frozen BitGo wallet; about $200,000 on its estimate, which it will cover; services still suspended. Unocoin’s update.
  • Kava Lend · KAVA bridged to BNB Chain and sold, in an incident Kava confines to its money market; the token fell about 40%. Kava has published no loss figure; The Block, citing on-chain data, put it near $3.76M, which we have not checked. our alert.
  • ACryptoS · a missing input check let 135 addresses drain about $665,000 from 77 vaults on five chains; the project is shutting down. our alert.
  • Ankr · five forged withdrawal receipts drained its Ethereum bridge of between about $286,000 and $305,000, by security firms’ counts. our alert.
  • LNbits · attacks on older versions of the Lightning wallet software cost users funds; no total published. the 1.7.0 fix.
  • Chainstack · default Grafana password; customer account data reached, node credentials treated as exposed; no loss of funds reported. the default password.
  • NEAR AI · a flaw in the open-source SGLang engine exposed about 100 users’ account details and two customers’ API keys, it says. the incident report.
  • Coinone · support contractor MetaM breached; passwords, bank details and ID numbers may be exposed; no funds taken, it says. Coinone’s notice.

Running total: not summed. Kava has given no figure, Initia’s $2.16M is frozen rather than gone, Proxima and Unocoin say customers are made whole, and three entries are data incidents with no dollar loss at all. Adding them would produce a number that describes nothing.

Elsewhere

  • The US Justice Department said a court had authorised it to seize or restrain more than $1.2 billion of the crypto stolen from Binance, and the FBI took down servers behind FaceStealer, a fake video-call scheme: the seizure.
  • Binance reopened withdrawals on 87 networks and said it aims to restore the rest by the end of next week: the recovery update.
  • South Korea’s financial regulator said exchanges may freeze withdrawals when a hack is only suspected, a step Gopax took on its own last week: the no-action letter.
  • Germany’s Bundestag passed a customs reform on 12 Nov that would let customs officers temporarily secure assets worth more than €100,000, crypto included, where there is reasonable doubt about their lawful origin, even without a criminal case. Only a fiscal court could order final confiscation, and the law still needs the Bundesrat’s consent before its planned start on 1 Jan 2027, as Der Spiegel reported.¹⁴

Close

The industry likes to describe its losses in the language of siege: attackers, exploits, sophisticated groups. Some weeks that is accurate. This week, mostly, it was housekeeping.

A key printed and forgotten. A log level changed for a good reason. A test server nobody turned off. A contractor holding what customers were told never to share.

None of this needs a genius on the other side. It needs someone patient enough to look in the places the owners stopped looking. So here is this week’s question, and it is cheaper than any audit: where are your spare keys, and who else has seen them?

See you next Sunday. — L.C.

Footnotes

  1. The Remaining Funds Week, 8 Nov.
  2. BitGo’s write-up, 13 Nov; see BitGo’s findings.
  3. BitGo on X, 13 Nov, 14:13 UTC, and its blog post the same evening. BitGo says its systems were not breached and no other clients were affected.
  4. Unocoin’s security update, 14 Nov, 13:13 UTC on X. Unocoin calls the figure “significantly less than 1%” of the crypto it holds for customers. We have not been able to check it on chain.
  5. Same update. Unocoin also says customer details, including emails and encrypted passwords, may be exposed, and that it has found no evidence KYC documents were accessed.
  6. Proxima’s post-mortem on X, 14 Nov, 22:16 UTC.
  7. The near-$400,000 figure is ours, at Kraken’s SOL price on Sunday morning. Proxima’s first estimate, on Saturday morning, was $200,000 to $250,000; see our first report. We found no statement from SigNoz or the consultant.
  8. Chainstack incident report, updated 11 Nov.
  9. Chainstack’s default password, 12 Nov.
  10. Initia halted at 06:18 UTC on 10 Nov; see Initia’s second halt, including the 11 Nov update.
  11. Initia on X, 10 Nov, 16:43 UTC. It says no INIT left the chain.
  12. Chain Check, 14 Nov.
  13. Coinone notice 5950, 15 Nov, 08:00 Korea time, translated from Korean; see Coinone’s contractor breach.
  14. Bundestag documentation lists the second and third readings on 12 Nov (Plenarprotokoll 21/108). Securing would last up to 30 days at first, extendable once by a fiscal court by up to 150 days, according to the bill as reported by German outlets.

References

  • Unocoin, Security Incident Update, 14 Nov 2026. https://blog.unocoin.com/security-incident-update/
  • BitGo, Unocoin Security Incident, 13 Nov 2026. https://www.bitgo.com/resources/blog/unocoin-security-incident/
  • Proxima post-mortem on X, 14 Nov 2026. https://x.com/0xTheo__/status/2121728996631269792
  • Initia on X, 10 Nov 2026. https://x.com/initia/status/2120195620442910943
  • Chainstack, incident report, updated 11 Nov 2026. https://chainstack.com/security-incident-nov-2026/
  • Coinone, notice 5950, 15 Nov 2026. https://coinone.co.kr/info/notice/5950
  • LNbits, 1.7.0 security update, 10 Nov 2026. https://news.lnbits.com/news/lnbits-1-7-0-security-update
  • NEAR AI, SGLang incident report, 9 Nov 2026. https://near.ai/blog/security-incident-report-sglang-vulnerability
  • Kava on X, 14 Nov 2026. https://x.com/KAVA_CHAIN/status/2121574325765476462
  • Bundespuls (Bundestag DIP data), Zollfinanzgerechtigkeitsgesetz. https://bundespuls.de/vorgang/338348
  • Der Spiegel, 12 Nov 2026. https://www.spiegel.de/wirtschaft/zoll-soll-schlagkraeftiger-werden-bundestag-beschliesst-neue-befugnisse-a-60710faa-d41e-4228-9e70-93f77bb5d02d

This article is for information only and is not investment advice.