Coinrail deleted its compensation clause ten days before losing a third of its coins

In the early hours of June 10, 2018, attackers drained roughly 3.6 billion tokens across nine types — Pundi X, NPER, Aston, TRON, Storm and others — from Coinrail's hot wallet in a 40-minute sweep. The haul was worth around ₩40 billion (about $37M), some 30% of everything the small Seoul exchange held, making it Korea's largest crypto exchange theft to that date. News of it knocked bitcoin down about 7% and erased roughly $30 billion of crypto market value within hours.

The breach landed ten days after Coinrail had rewritten its terms. In April 2018 Korea's Fair Trade Commission reviewed twelve exchanges' terms, found fourteen types of unfair clauses — chiefly blanket disclaimers shifting hacking losses onto customers — and ordered corrections. Rivals rewrote their compensation clauses in May; Coinrail instead deleted Article 20(4), the damage-compensation provision, outright on May 31, keeping only the clause that preserved the company's own claims against members. The FTC noted deletion does not erase liability: civil law requires cash compensation.

Trading went dark for more than a month. The exchange's first statement said 70% of assets were safe in cold storage, that two-thirds of the stolen tokens had been frozen with issuers and partner exchanges, and that the theft involved lesser-known tokens rather than bitcoin. When service resumed on the evening of July 15, its own recovery notice told a different story: 34.8% of users' bitcoin was still unrecovered, alongside TRX 33.1%, KNC 29.9%, STORM 56.1%, NPXS 84.2%, ATX 42.9% and NPER 89.4%.

The recovery plan gave users two options: wait for the exchange to buy back unrecovered tokens from future operating profits, or swap balances into RAIL, Coinrail's own token, at a fixed 1 RAIL = ₩0.72. Investors rejected both as uncertain in value and filed embezzlement complaints against CEO Nam Kyung-sik; on July 5, 2018, Gangnam police referred the case to the Seoul Central District Prosecutors' economic crimes team, which needed the real scale of the losses to pursue it.

~$37M (₩40B) in tokens gone — including 34.8% of users' bitcoin unrecovered; trading dark for five weeks while markets fell

Two-thirds of the exchange's assets sat in an internet-connected hot wallet, so 30% of everything users owned was exposed to a single intrusion that took forty minutes.

The compliance response to the FTC's order was deletion rather than repair — the clause that would have anchored customers' compensation claims was the one thing removed.

The initial disclosure minimized the loss: 'bitcoin untouched' became '34.8% of bitcoin unrecovered' only when service resumed five weeks later.

Compensation was denominated in the failed company's own token and in its future profits — instruments whose value depended entirely on the entity that had just failed to protect the assets.

Deleting the clause that promised customer compensation does not delete the obligation — and an exchange that keeps a third of customer assets in a hot wallet owns every loss that follows.

Withdrawals reopened on July 15, 2018 only for recovered coins; the rest of users' balances defaulted into the buy-back-or-RAIL options. An embezzlement complaint against CEO Nam Kyung-sik reached Seoul prosecutors on July 5, 2018, with the loss size still to be verified. The Fair Trade Commission's position stood on the record: deleting a clause does not exempt an exchange from paying cash compensation. Within months Korea moved to require real-name trading accounts and security certification for exchanges, tightening the regulatory gap this hack exposed.