Key Takeaways
- Unocoin confirmed approximately $200,000 in cryptocurrency losses across three of its more than 20 operational hot wallets.
- Investigators determined that Unocoin-controlled backup signing keys were compromised, while Bitgo’s infrastructure remained unaffected.
- Customer information may have been exposed, although Unocoin says it found no evidence that identity verification documents were accessed.
Unocoin’s $200K Revelation Rewrites Earlier Security Assurances
Unocoin’s Nov. 14 disclosure marks a significant departure from the company’s initial assessment following the Nov. 6 security incident. On Nov. 9, the Bengaluru-based exchange maintained that its intervention with custody providers had prevented cryptocurrency losses.
Subsequent forensic examinations, however, uncovered unauthorized transactions involving three operational hot wallets used for activities including customer withdrawals. The estimated $200,000 loss represents significantly less than 1% of cryptocurrency assets held on behalf of customers, according to Unocoin.
The exchange pledged to absorb the financial damage rather than impose losses on account holders. “Unocoin will fully fund the identified loss from its own resources,” the company stated, adding that affected cryptocurrency balances would not be reduced.
Unocoin also reported successfully freezing a portion of the affected funds through coordination with industry partners, although it did not disclose the amount recovered or restricted.
Eight-Year-Old Backup Keys Emerge as Critical Vulnerability
Perhaps the investigation’s most consequential finding concerns encrypted backup signing keys generated approximately eight years ago, printed on paper, and placed in secure physical storage. Investigators determined that these Unocoin-controlled keys were compromised and subsequently used to authorize unauthorized cryptocurrency transfers.
The exchange acknowledged that investigators have yet to establish precisely how the keys were accessed, despite identifying a decryption passphrase within compromised infrastructure. The findings also reinforce Bitgo’s Nov. 13 explanation that its custody systems were never breached.
Under Unocoin’s two-of-three multisignature arrangement, the exchange controlled two signing keys, allowing transactions to be authorized without Bitgo’s participation. The custodian previously explained that the suspicious transactions were signed using Unocoin’s user and backup keys before being broadcast independently to blockchain networks.
Customer Data Exposure Raises Additional Questions
Beyond the cryptocurrency theft, Unocoin acknowledged that portions of its infrastructure may have exposed registered email addresses, residential addresses, encrypted passwords, account balances, and know-your-customer (KYC) information.
However, the company emphasized that investigators have not identified evidence of unauthorized access to actual identity verification documents. Customers were warned about targeted phishing attempts exploiting potentially compromised personal information.
Meanwhile, Unocoin continues rebuilding its infrastructure, conducting security audits, and investigating the circumstances surrounding the compromised signing keys before restoring services.
The exchange’s latest admission resolves the immediate question of whether cryptocurrency was stolen, but leaves important uncertainties surrounding data exposure, key security, and operational recovery. Its promise to reimburse customers addresses the financial shortfall, while the unresolved method of compromise presents a more complicated challenge to restoring confidence.
