Coinrail Cyber Intrusion Exposes Exchange Risk as Crypto Markets Slide

Coinrail reports a cyber intrusion

South Korean cryptocurrency exchange Coinrail disclosed a cyber intrusion on June 10, 2018, suspended trading while it reviewed its systems, and said it had frozen several exposed token balances. The incident mattered beyond the venue’s size: it showed how an exchange compromise could force emergency action by token issuers and other trading platforms, while a broad digital-asset selloff was already under way.

Pundi X, the issuer of NPXS, supplied the clearest surviving contemporaneous operational record. It said Coinrail notified it on June 10 of unauthorized activity involving 2,619,542,080 NPXS transferred to IDEX. Pundi X said Coinrail had confirmed that a cyber intrusion caused the incident and that NPXS was among the affected tokens. That account establishes the incident and one token quantity, but it does not establish a complete loss total for Coinrail customers.

Coinrail’s notice, as described by Bloomberg on June 10, said the exchange was reviewing its system after hacking attempts. The exchange reported freezing exposed NPXS, NPER and ATX and moving other cryptocurrency holdings into cold storage. Trading interruption and asset isolation were containment measures, not proof that every affected asset had been recovered or that the intrusion’s cause was known.

Emergency controls crossed company boundaries

The response illustrated a distinctive feature of the 2018 token market. Pundi X said 2,619,542,080 NPXS represented 3% of the token’s then-current supply. At 11:16 a.m. Singapore time on June 10, it halted all NPXS transactions through an emergency security procedure. At 1:08 p.m. Singapore time, according to Pundi X, IDEX agreed to freeze the account involved in the suspicious trading. Pundi X also said Korean law enforcement requested at 7:01 p.m. Singapore time that the suspension be extended for the investigation.

Those steps were issuer and platform interventions, not a reversal by the Ethereum network. They demonstrated that an ERC-20 token could remain technically traceable while access to transfers or trading was constrained by organizations controlling a smart contract or exchange account. Pundi X explicitly said its own system had not been hacked; its tokens were held at the compromised exchange.

The limits were equally important. “Trackable” did not mean recovered, and a frozen trading account did not establish the identity of the person controlling the destination address. Coinrail and Pundi X described an investigation in progress. No event-day primary record reviewed for this reconstruction supplied a complete forensic report, customer-by-customer accounting or independently audited valuation of the affected assets.

A market drop, with causation unproven

Bitcoin was already extending losses for a third session when the Coinrail disclosure circulated. Bloomberg’s June 10 report, using Bitstamp pricing, recorded bitcoin at $7,242 at 5:28 p.m. Hong Kong time, down 5.1% and after falling as much as 6% during the session. Bloomberg also reported that ether and XRP had each declined at least 6.2% by that observation point.

That is a venue-specific snapshot, not a universal cryptocurrency close. Bitcoin trades continuously, Bitstamp was one market, and the percentage reflected Bloomberg’s stated session comparison and timestamp. The temporal overlap supports the narrower conclusion that the breach intensified an atmosphere of security concern. It does not prove the Coinrail news caused the entire move. The selloff had begun before the disclosure, and other market and regulatory concerns were active.

Later clarification

Reuters reported on June 11, 2018 that Coinrail said roughly 30% of the coins traded on the exchange were lost and 70% were secured in cold storage. Reuters also relayed Yonhap’s estimate of 40 billion won, or $37.28 million, rather than a Coinrail valuation. Those figures clarify the early record but should be treated as company-reported proportions and a third-party estimate, not an event-day audited loss statement.