Unocoin has put a number on its breach for the first time. The Indian exchange says about $200,000 in crypto left three of its hot wallets, that it will cover the loss itself, and that the transfers were approved with backup keys it generated roughly eight years ago and kept on paper. It also says customer details, including email and home addresses, encrypted passwords and KYC-related information, may have been exposed. Services remain suspended.
What Unocoin said on Saturday
The figures come from a new section of Unocoin’s security incident update, dated Nov. 14, which the exchange also summarized on X. When it first assessed the incident on Nov. 9, Unocoin said, it had found no loss of funds. Later work showed that unauthorized transactions had gone out from “a small number” of hot wallets. Three of the more than 20 operational wallets it keeps, including ones used for customer withdrawals, were compromised.
The estimated loss is about $200,000, which Unocoin says is “significantly less than 1%” of the crypto it holds for customers. “Unocoin will fully fund the identified loss from its own resources,” the update said, adding that the loss will not be passed on to customers or taken from their balances. It also said part of the stolen funds has already been frozen through industry contacts, without giving an amount.
Paper backup keys, and a puzzle
The most striking finding concerns the backup keys for Unocoin’s BitGo multisignature wallets. Those keys were generated about eight years ago, encrypted, printed on paper and placed in secure physical storage, the exchange said. Its investigation has established that they were compromised and then used to approve the transfers.
How that happened is still open. “The decryption passphrase to the printed encrypted backup keys existing in our compromised infrastructure is not fully solving the puzzle,” Unocoin wrote. In other words, the passphrase sat on systems the attacker reached, but the exchange has not explained how the encrypted key material itself, which it says was printed and stored offline, ended up in an attacker’s hands. Finding that out is the first item on its list of next steps.
BitGo had already set out the signing side. In a blog post on Friday, the custody firm said the affected wallet used a 2-of-3 setup in which Unocoin held the user key and the backup key, and BitGo held the third. The Ethereum transfers it reviewed were signed with Unocoin’s user and backup keys and broadcast outside BitGo’s platform, and “BitGo’s key was not used,” it said. BitGo said the transfers also involved XRP, HBAR and EOS, and that it has advised Unocoin to move its remaining funds to new wallets backed by newly generated keys. That explains why the account freeze Unocoin ordered on Nov. 6 did not stop anything. “The freeze does not lock funds at the blockchain level,” BitGo wrote.
What the Ethereum wallet shows
The on-chain record fits that account, and shows the draining took place over more than one day. The backup-key address BitGo named sent 125 transactions to the multisig wallet between Nov. 9 and Nov. 11, 26 of which failed, according to Blockscout data we reviewed. Over the same period the wallet made 95 token transfers to a single receiving address, 91 of them on Nov. 9 and four more on Nov. 11, two days after Unocoin suspended services. The largest stablecoin amounts were about 36,265 USDT and about 6,728 USDC. The rest was a long tail of older ERC-20 tokens, which is consistent with a wallet that had served an exchange for years.
Those Ethereum amounts cover only part of the $200,000 estimate. The remainder sat on the other networks BitGo listed, which we have not traced.
Customer data and what comes next
Unocoin said it is treating “a significant portion” of its infrastructure as potentially compromised. Potentially exposed data includes registered email addresses, residential addresses, encrypted account passwords, KYC-related information and account balances. “At this stage, we have not found evidence that customer KYC documents were accessed,” the exchange said, while warning users to expect targeted phishing that uses their personal details.
The update also included an apology for how slowly news has come out. “We acknowledge this communication gap and apologise for the uncertainty it may have caused,” Unocoin said. The exchange first disclosed the breach as a Nov. 9 login suspension, moved the start date back to Nov. 6 in its Nov. 12 update, and said on Nov. 13 that the BitGo freeze had held while funds still moved. It has not given a date for restoring services, saying it is rebuilding its infrastructure and running security audits first.
FAQ
How much did Unocoin lose?
Unocoin estimates the loss at about $200,000 from three hot wallets, which it says is well under 1% of customer crypto it holds. It says it will cover the loss from its own funds.
Was BitGo hacked?
No, according to both companies. BitGo says the transfers were signed with Unocoin’s own user and backup keys and broadcast outside its platform, and Unocoin says BitGo’s infrastructure was not compromised.
What customer data may have been exposed?
Unocoin lists email addresses, residential addresses, encrypted passwords, KYC-related information and account balances. It says it has found no evidence that KYC documents were accessed.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
