Indian cryptocurrency exchange Unocoin confirmed Saturday, Nov. 14, that attackers stole approximately $200,000 in cryptocurrency from three compromised hot wallets—a direct reversal from its Nov. 9 statement claiming custody intervention had prevented losses.
Unocoin initially said its coordination with custody providers had blocked any theft following the Nov. 6 incident. Forensic analysis later uncovered unauthorized transactions across three operational hot wallets used for customer withdrawals. The $200,000 loss represents less than 1 percent of customer cryptocurrency holdings.
The Bengaluru-based exchange will absorb the entire loss from its own capital, keeping customer balances whole.
Investigators traced the breach to encrypted backup signing keys printed on paper and stored in Unocoin's physical vault approximately eight years ago. Those keys were accessed and used to authorize unauthorized transfers. While a decryption passphrase was found in compromised infrastructure, Unocoin acknowledged it has not determined the precise method attackers used to access the physical keys.
Unocoin operated a two-of-three multisignature arrangement, holding two of the three signing keys itself. This structure allowed transactions to proceed using only Unocoin's keys without requiring Bitgo's participation—consistent with Bitgo's Nov. 13 statement that its custody systems remained unbreached.
Beyond the cryptocurrency loss, Unocoin disclosed that portions of its infrastructure exposed sensitive customer data: registered email addresses, residential addresses, encrypted passwords, account balances and KYC information. The company found no evidence of unauthorized access to identity verification documents but warned customers of potential targeted phishing attempts exploiting the exposed personal information.
Unocoin froze a portion of the stolen funds through coordination with industry partners but did not disclose the specific amount recovered or restricted.
The exchange is rebuilding its infrastructure and conducting security audits while investigating how the signing keys were compromised.
