Unocoin puts its breach loss at about $200,000 from three hot wallets and blames paper backup keys printed eight years ago

Unocoin, the Bengaluru based cryptocurrency exchange founded in 2013, has given its first loss figure for the security incident that has kept its platform offline since November 9. In an update on its blog, the company says three of the more than 20 hot wallets it runs for day to day operations, including customer withdrawals, were compromised, and that the crypto taken is estimated at about $200,000. It says it will pay for the loss from its own resources, that no customer balance will be reduced, and that a portion of the affected funds has already been frozen through industry contacts, without saying how much.

The incident began on November 6, when Unocoin spotted suspicious activity and asked its custody providers, Fireblocks and BitGo, to freeze its enterprise accounts. After more unauthorised activity on November 9 it suspended all services and disabled logins, and on November 12 it decided to rebuild its servers from scratch rather than restore the old setup. Its early statements said no crypto had been lost; the new update says later checks found unauthorised transactions from a small number of hot wallets.

The surprising part is how the money moved. Unocoin's affected wallets used a two of three multisignature setup in which it held the user key and the backup key, and BitGo held the third. According to Unocoin, the backup keys were generated about eight years ago, encrypted, printed on paper and kept in secure physical storage, and they were then compromised and used to approve the transfers. The company says the passphrase needed to decrypt those keys was present on its breached infrastructure but that this does not fully explain what happened. BitGo's own write up says its key was never used, the transactions were signed with Unocoin's two keys and broadcast directly to the blockchain, and it has advised Unocoin to move remaining funds to wallets with newly generated keys.

Customers also face a data question. Unocoin says details such as email addresses, home addresses, encrypted passwords and KYC related information may have been exposed, though it has found no evidence so far that KYC documents themselves were accessed. Unocoin says the loss is well under 1% of the crypto it holds for customers and that more than 90% of customer funds sit in cold storage; these are the company's own figures, which MABOnChain notes have not been independently verified, and TokenPost reports that services have not yet resumed.

For Indian crypto users the episode is a sharp reminder that custody risk is not only about hot servers: an old backup kept offline can become the weak point. The things to watch now are whether Unocoin can explain how the keys were reached, how much of the frozen money comes back, and when customers can log in and withdraw again.