Indian exchange Unocoin pauses services after a 9 November breach and says it will cover an estimated $200,000 loss
What happened. Unocoin reported unauthorised access to its servers on 9 November and paused user logins, PANews reported, citing Onchain Lens. Unocoin denied that all funds had been stolen and said no user funds were lost, PANews reported on 12 November; on X it later said 3 of its more than 20 operational hot wallets were compromised, with an estimated loss of about $200,000 that it will cover in full from its own funds without reducing user balances, PANews reported.
Why it matters. Unocoin's custody provider BitGo said the outgoing transactions were signed with two keys Unocoin holds, without BitGo, and that its own systems were not compromised, PANews reported. Unocoin later said what was stolen was a backup signing key it controls itself, not BitGo's infrastructure, according to PANews.
- Arkham showed a zero balance across 81,000 tracked Unocoin addresses and the exchange's website returned a 504 error, PANews reported, citing Onchain Lens.
- Unocoin said BitGo froze its enterprise account on 6 November at Unocoin's request and the freeze worked as intended, but the unusual outgoing transactions were signed and broadcast outside the BitGo platform, PANews and TechFlow reported.
- Unocoin's initial findings were that the backup mechanism in BitGo's multisig wallet, meant to let users reach funds when the provider is unavailable, may have been exploited, TechFlow and PANews reported.
- BitGo said Unocoin's wallet is a 2-of-3 multisig self-custody setup in which Unocoin holds two keys and BitGo holds a third that was never used, and that no other client was affected, PANews reported.
- Unocoin said some affected funds have been frozen and some user information may have leaked, but it has found no access to KYC files, PANews reported.
Read the originals (6), usually in their own language:
- Indian crypto exchange Unocoin suspected of being attacked; 81,000 tracked addresses show zero balance · PANews, headline translated by us
- Indian crypto exchange Unocoin denies 'all funds stolen', says pause in services is a proactive security measure · PANews, headline translated by us
- Unocoin says BitGo multisig backup mechanism suspected of being exploited; investigating asset losses · PANews, headline translated by us
- Indian crypto exchange Unocoin: unusual on-chain transactions bypassed the BitGo platform to be signed and broadcast; investigating asset losses · TechFlow, headline translated by us
- BitGo: Unocoin's recent outflows were not signed by BitGo; its systems were not compromised · PANews, headline translated by us
- Indian exchange Unocoin admits 3 hot wallets were hacked, a loss of about $200,000 · PANews, headline translated by us