Unocoin says $200,000 was stolen from hot wallets and warns of possible data exposure

Earlier assurances reversed after forensic review

Unocoin said investigators identified unauthorized transactions affecting three of its more than 20 operational hot wallets used for customer withdrawals. Based on that review, the exchange now puts the crypto loss at roughly $200,000.

The company said the stolen amount accounts for less than 1% of assets it holds for customers. It added that it will absorb the loss itself and restore affected balances so customer holdings are not reduced.

Unocoin also said some of the stolen funds were frozen with the help of partners, although it did not disclose how much has been recovered.

Compromised backup keys, not a BitGo breach

According to the exchange, the attack did not stem from a breach of BitGo’s custody infrastructure. Instead, the investigation found that backup signing keys generated eight years ago and stored on paper were compromised and then used to authorize transfers.

Unocoin said the exact method used to access those keys is still unknown. Investigators did, however, find a decryption passphrase inside the compromised system, adding to questions about how the signing setup was exposed.

The exchange said it operated a two-of-three multisignature arrangement in which Unocoin controlled two keys. That meant transactions could be approved with Unocoin-managed keys alone, without BitGo taking part. The suspicious transfers were signed with Unocoin’s own keys before being broadcast to the blockchain.

Customer information may have been exposed

Alongside the wallet theft, Unocoin said parts of its infrastructure may have exposed sensitive user information. The potentially affected data includes registered email addresses, residential addresses, encrypted passwords, account balances and KYC information.

At the same time, the company said investigators have found no evidence that identity verification documents were accessed. Even so, Unocoin warned customers to be alert to targeted phishing attempts that could make use of personal details obtained during the incident.

Rebuild and investigation are still under way

Unocoin said it is rebuilding infrastructure, carrying out security audits and continuing to investigate how the backup signing keys were compromised. Services are to remain affected until that work is completed and systems are restored.

The confirmed crypto loss appears to be financially contained, but several questions remain unresolved, including the path used to access the backup keys, the full extent of any data exposure and the timeline for operational recovery.