Unocoin Confirms $200K Hot Wallet Loss, Warns of Data Exposure
Indian exchange Unocoin confirmed on Nov. 14 that attackers stole about $200,000 from three hot wallets using compromised Unocoin-controlled backup keys. It will cover the loss and warned customer data, including KYC information, may have been exposed.
Attackers stole about $200,000 in cryptocurrency from three Unocoin hot wallets, the Indian exchange confirmed on Saturday, Nov. 14. It added that customer data may also have been exposed. The admission reverses Unocoin's Nov. 9 position that its intervention with custody providers had prevented losses.
The three wallets were among more than 20 operational hot wallets. Unocoin says the loss is significantly less than 1% of the crypto it holds for customers and that affected balances will not be reduced.
"Unocoin will fully fund the identified loss from its own resources"
Unocoin, company statement
Investigators found that encrypted backup signing keys controlled by Unocoin were compromised and used to authorize the transfers. The keys were generated about eight years ago and printed on paper kept in secure physical storage. A decryption passphrase was identified within compromised infrastructure, but investigators have not established how the keys were accessed.
That fits the account BitGo gave a day earlier. As BitGo said on Nov. 13, its systems were not breached and the transfers were signed with Unocoin's user and backup keys. In a two-of-three multisig setup, holding two of the three keys lets the holder sign without the custodian. Unocoin controlled both.
BitGo's own documentation says its withdrawal policies apply only to transactions involving BitGo, so recovery transactions signed with the user and backup keys bypass them. That would explain how transfers were signed and broadcast outside BitGo while the freeze on Unocoin's BitGo enterprise account held.
Customer data exposure
Unocoin said possibly exposed data includes registered email addresses, residential addresses, encrypted passwords, account balances and KYC (know-your-customer) information. It found no evidence that identity verification documents were accessed. Customers were warned to expect targeted phishing.
The company said it froze part of the affected funds with industry partners but did not disclose the amount.
Timeline and status
Unocoin first detected the activity on Nov. 6 and asked BitGo and Fireblocks to freeze its enterprise accounts. It suspended all services on Nov. 9 after further unauthorized activity, then identified outgoing transactions from an Ethereum address in its BitGo wallet infrastructure on Nov. 12. In its Nov. 12 report it said more than 90% of customer crypto was held in cold storage.
Unocoin's incident update says it is still investigating losses and information exposure. The exchange continues to rebuild infrastructure and run security audits, and has given no restart date.
Two questions remain open: how the keys were accessed and how much of the stolen funds has been frozen. Unocoin's findings place the compromise in keys the exchange itself controlled, with BitGo's infrastructure unaffected, consistent with BitGo's Nov. 13 statement.
