At a glance
- Indian exchange Unocoin says an estimated $200,000 in crypto left three of its operational hot wallets, a figure it calls “significantly less than 1%” of the crypto it holds for customers. It will pay the loss from its own resources and says no customer balances will be reduced, according to its security update.
- It says its own paper backup keys were compromised, and that customer details, including emails, home addresses, encrypted passwords and KYC-related information, may be exposed. It has found no evidence that KYC documents were accessed.
Unocoin’s update, posted on its blog and on X at 13:13 UTC (18:43 IST) on Saturday, is the first time the exchange has put a number on the incident.
On 9 Nov it had found no loss of crypto. On Friday, BitGo said Unocoin’s own user and backup keys signed the transfers, without BitGo’s key. We first reported the outgoing transfers from a frozen wallet on 12 Nov.
The loss
A hot wallet is a wallet connected to the internet, used for day-to-day withdrawals. Unocoin runs more than 20 for operations, and says three were compromised.
It says a portion of the affected funds has been frozen, but gives no figure for that. The loss will not be passed on to customers or taken out of their balances, it says.
The $200,000 is Unocoin’s estimate. We have not been able to check it against on-chain data.
The backup keys
Unocoin says the transactions got their second required signature from a backup key that it holds itself.
Those keys were generated about eight years ago, encrypted, printed on paper and kept in secure physical storage, it says. They were later compromised and used to approve the transactions.
How that happened is unexplained. Unocoin says the passphrase that decrypts the printed keys existed in its compromised infrastructure but “is not fully solving the puzzle”. It says it is still investigating.
It also repeats that BitGo’s infrastructure was not breached and that the transactions were not signed by BitGo. BitGo said the same on Friday.
Customer data
Unocoin says it is treating much of its infrastructure as potentially compromised. The details that may have been exposed are:
- registered email addresses
- residential addresses
- encrypted account passwords
- KYC-related information
- account balances across tokens
It has found no evidence yet that customers’ KYC documents were accessed, and says it is still checking whether data was taken. It warns that phishing messages that use personal details may look genuine.
What we don’t know
Unocoin has not said when its services will return, how the backup keys were reached, or how much of the frozen amount it can recover. It has not said how many customers’ details are involved.
It acknowledges that users expected more frequent updates and apologises for the gap.
Why it matters: the exchange has moved from “no loss” to a named figure and a data-exposure warning in five days, and the key question is now how its backup keys were reached. Until it answers, treat any call, message or email that mentions your Unocoin account with suspicion. Unocoin says it will never ask for passwords, OTPs, private keys or recovery phrases. A private key is the secret that approves a transfer, which is why a leaked backup key matters so much.
Next, watch for Unocoin’s further update on how the keys were compromised and a date for services.
This article is for information only and is not investment advice.