Coinrail Says Breach Affected About 30% of Its Crypto Holdings

South Korean cryptocurrency exchange Coinrail said on June 11, 2018 that a “cyber intrusion” detected during the early hours of June 10 had affected part of the assets it held. The exchange suspended service while it checked its systems and said 70% of its coin and token reserves had been secured and moved to offline cold wallets. That left roughly 30% in the affected category, according to Coinrail’s own description reproduced by contemporaneous reports.

The disclosure mattered beyond Coinrail’s size. It arrived while crypto trading remained fragmented across lightly supervised venues, and it showed how a centralized exchange could become the single point of failure for assets issued on otherwise distributed networks. Coinrail’s percentage was a company claim, not an independently audited balance-sheet figure, and the exchange did not publish a complete wallet-by-wallet reconciliation on June 11.

Token issuers moved to contain the breach

Pundi X, one of the affected token projects, provided the clearest surviving primary account. It said Coinrail notified it on June 10 of unauthorized activity involving 2,619,542,080 NPXS tokens transferred from the exchange toward IDEX. Pundi X characterized that amount as 3% of the then-current NPXS supply.

The project said it halted all NPXS transactions at 11:16 a.m. Singapore time on June 10 and that IDEX agreed at 1:08 p.m. to freeze the account involved. Those are attributable claims by an affected issuer, not a complete forensic finding. They establish a concrete incident response and a specific token quantity, but they do not by themselves prove the attacker’s identity, the entry method, or Coinrail’s total economic loss.

Coinrail’s statement, as reported on June 11, said roughly two-thirds of the affected assets had been frozen or recalled through cooperation with token developers and other exchanges. The remaining third was still under review with investigators and counterparties. South Korean police were reported to have opened an investigation. No verified reimbursement plan, final recovery figure, or root cause was available on June 11.

The market reaction was sharp, but causation was uncertain

A CoinMarketCap historical snapshot for June 10 recorded bitcoin at $6,786.02, down 9.67% over 24 hours, with reported 24-hour volume of $5.805 billion and a market capitalization of $115.948 billion. The same snapshot showed ether at $526.48, down 11.21% over 24 hours.

Those figures are provider-level aggregates across trading venues, not a single executable price or a controlled measure of the breach’s effect. Contemporaneous coverage linked the selloff to renewed exchange-security fears, but the timing does not establish that Coinrail alone caused the move. Coinrail was a relatively small venue, the assets publicly identified as affected were tokens including NPXS, NPER and ATX, and the surviving June 11 record does not establish that bitcoin itself was stolen.

The widely circulated loss estimate of 40 billion won, or about $37.28 million, came from a Yonhap estimate relayed by Reuters; Reuters described the estimate as unsourced, while Coinrail did not quantify the loss. It therefore should not be treated as a confirmed theft total.

What was knowable on June 11

The defensible conclusion on June 11 was narrower than the headlines: Coinrail had acknowledged an intrusion, trading was halted, an affected issuer documented a multibillion-token transfer and emergency freeze, and the exchange said most reserves were moved to cold storage. The final loss, recovery rate, attack method and customer impact remained unresolved. The episode underscored that blockchain settlement did not eliminate operational and custody risk at the exchanges through which many customers accessed digital assets.