← Coinrailreviewed 2026-09-07 · 24 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Coinrail against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
1 claimNo source the reviewer could reach confirms or contradicts the claim.
- #14[unverifiable][awaiting moderator]in section: Law Enforcement Response
“No public announcements of arrests or definitive attribution were issued by Korean authorities based on available reporting.”
reviewerNo public announcements of arrests or definitive attribution were issued by Korean authorities.This is an absence-of-evidence claim; a systematic search through 2026 turned up no reports of arrests, which is consistent with the page's careful hedged phrasing ('based on available reporting'), but cannot be affirmatively confirmed as a negative.
link rot
2 claimsA cited source no longer resolves or no longer says what the page attributes to it.
- #23[link rot][awaiting moderator]in section: Market Impact
“https://cointelegraph.com/news/buy-the-fud-mainstream-media-convinced-coinrail-hack-caused-crypto-price-plunge”
reviewerThe 'Buy the FUD' CoinTelegraph article is a live, citable source for the Market Impact section.The URL is dead with no available archive. The underlying claim it supported is still corroborated by the other three sources in the same section plus a search-engine cache of the original article's content, but the citation itself should be removed since no live or archived copy could be located. - #24[link rot][awaiting moderator]in the cited sources
“https://cointelegraph.com/news/buy-the-fud-mainstream-media-convinced-coinrail-hack-caused-crypto-price-plunge”
reviewerThe 'Buy the FUD' CoinTelegraph URL listed in sources_used is a live, working source.Same underlying dead link as the section-level citation; grouped under the same defect_group.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #17[partially supported][awaiting moderator]in section: Operational Aftermath and Exchange Status
“Coinrail had ranked approximately seventh among South Korean exchanges by trading volume before the incident.”
reviewerCoinrail had ranked approximately seventh among South Korean exchanges by trading volume before the incident.The fact itself is true and independently corroborated by CoinMarketCap and Korea Herald, but one of the three sources listed for this section (The Next Web) does not actually support this specific ranking claim; it discusses a different (global, not domestic) ranking.
confirmed
20 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“Coinrail was a small South Korean cryptocurrency exchange that suffered a major security breach on June 10, 2018, resulting in the theft of approximately $40 million worth of ERC-20 tokens including NPXS (Pundi X), ATX (Aston X), DENT, and others.”
reviewerCoinrail suffered a security breach on June 10, 2018, resulting in theft of approximately $40 million in ERC-20 tokens including NPXS, ATX, and DENT.Both cited primary contemporaneous reports confirm the date and approximate loss figure. - #2[confirmed][no action needed]in the summary
“The incident triggered a broader cryptocurrency market sell-off, contributing to a loss of over $40 billion in total crypto market capitalization.”
reviewerThe incident triggered a broader crypto sell-off contributing to a loss of over $40 billion in total market capitalization.Figure matches NPR reporting; page appropriately frames this as contribution/correlation rather than sole causation, which matches the more skeptical CoinTelegraph analysis also cited elsewhere on the page. - #3[confirmed][no action needed]in section: The June 2018 Security Breach
“On June 10, 2018, Coinrail announced on its website that it had suffered a 'cyber intrusion' affecting approximately 30 percent of the ERC-20 tokens held on the exchange.”
reviewerCoinrail announced on its website a 'cyber intrusion' affecting approximately 30 percent of ERC-20 tokens held on the exchange.Directly confirmed. - #4[confirmed][no action needed]in section: The June 2018 Security Breach
“The attack targeted the exchange's hot wallet infrastructure, and stolen assets were transferred to external addresses subsequently labeled 'Fake_Phishing1432' and 'Fake_Phishing1431' by on-chain analysts.”
reviewerStolen assets were transferred to addresses subsequently labeled 'Fake_Phishing1432' and 'Fake_Phishing1431' by on-chain analysts.Both address labels and their relationship (1431 -> 1432 -> IDEX) are independently corroborated by contemporaneous reporting on Etherscan labeling. - #5[confirmed][no action needed]in section: The June 2018 Security Breach
“Korean cybersecurity experts investigating the breach noted that the attack may have been facilitated by a compromised machine inside the company with administrative access, though the identity of the attacker was never publicly confirmed.”
reviewerKorean cybersecurity experts noted the attack may have been facilitated by a compromised machine inside the company with administrative access.Corroborated by an independent secondary source describing the same theory in similar terms. - #6[confirmed][no action needed]in section: Stolen Assets and Token Breakdown
“According to reporting corroborated by multiple sources and the affected token projects, the hackers stole approximately 2.6 billion NPXS (Pundi X) tokens valued at roughly $19.5 million, 93 million ATX (Aston X) tokens valued at approximately $13.8 million, 831 million DENT tokens valued at approximately $5.8 million, and over $1 million in TRON (TRX) tokens.”
reviewerThe hackers stole approximately 2.6 billion NPXS tokens (~$19.5M), 93 million ATX tokens (~$13.8M), 831 million DENT tokens (~$5.8M), and over $1 million in TRX.Every figure matches the TechCrunch and CoinDesk contemporaneous reporting precisely. - #7[confirmed][no action needed]in section: Stolen Assets and Token Breakdown
“Additionally, 1,927 ether (ETH) and significant amounts of at least six other smaller tokens were taken.”
reviewer1,927 ether and significant amounts of at least six other smaller tokens were taken.Matches TechCrunch reporting exactly. - #8[confirmed][no action needed]in section: Market Impact
“Bitcoin's price fell approximately 7 to 11 percent in the days following the announcement, dropping to around $6,700 on major exchanges. The broader crypto market lost over $40 billion in total market capitalization during the weekend and into Monday, with the total market cap falling from approximately $340 billion to around $291 billion.”
reviewerBitcoin's price fell approximately 7 to 11 percent, dropping to around $6,700; market cap fell from ~$340B to ~$291B, a loss of over $40 billion.The 7-11% range synthesizes multiple contemporaneous reports (NPR ~7%, CNN ~10-10.8%) accurately. - #9[confirmed][no action needed]in section: Market Impact
“Some analysts cautioned that Coinrail's small size — ranked outside the top 90 exchanges by volume — made it an unlikely single cause for such a broad market move, and noted that Bitcoin had already been in a prolonged downtrend since its late-2017 peak near $20,000 and that concurrent US regulatory scrutiny of the crypto market was also weighing on prices.”
reviewerCoinrail's small size — ranked outside the top 90 exchanges by volume — made it an unlikely single cause for the broad market move.The underlying claim is corroborated via search-engine cache of the CoinTelegraph piece, but the cited URL for this section is dead; see the separate link_rot finding for that source. - #10[confirmed][no action needed]in section: Recovery Efforts and Token Freezes
“Coinrail stated that approximately 70 percent of its total coin and token reserves were confirmed safe, having been moved to cold storage prior to or immediately following discovery of the breach. Of the 30 percent that were compromised, the exchange reported that two-thirds — valued at roughly $27 million — were subsequently frozen or recovered in coordination with token issuers, partner exchanges, and South Korean law enforcement.”
reviewer70 percent of Coinrail's reserves were confirmed safe in cold storage; two-thirds of the compromised 30 percent (~$27 million) were subsequently frozen or recovered.Cross-confirmed by a second independent outlet with consistent arithmetic. - #11[confirmed][no action needed]in section: Recovery Efforts and Token Freezes
“Pundi X took several actions: it suspended the NPXS smart contract for 10 days at the request of Korean police investigating the incident, delisted NPXS from the IDEX decentralized exchange after the attacker attempted to liquidate stolen tokens there on June 25-26, 2018, and blocked monthly token distributions to the attacker's wallet address.”
reviewerPundi X suspended the NPXS smart contract for 10 days at Korean police's request and delisted NPXS from IDEX after a liquidation attempt on June 25-26, 2018.Directly confirmed by the primary source (Pundi X's own blog). - #12[confirmed][no action needed]in section: Recovery Efforts and Token Freezes
“Aston (ATX) and NPER also froze their affected tokens. NPER announced plans to incinerate its stolen tokens to render them unredeemable.”
reviewerAston (ATX) and NPER also froze their affected tokens; NPER announced plans to incinerate its stolen tokens.Confirmed by an independent secondary source in addition to the cited TechCrunch piece. - #13[confirmed][no action needed]in section: Law Enforcement Response
“According to a police spokesperson quoted by the Korea Herald, investigators secured the access history of Coinrail's servers and began analyzing them. Authorities noted at the outset that they would determine whether the incident constituted an external hack or resulted from internal technical failure. The Korea Internet and Security Agency (KISA), a state-run cybersecurity body, conducted a parallel technical analysis. A KISA representative indicated that determining the root cause would take approximately one month.”
reviewerSouth Korean police secured the access history of Coinrail's servers and began analyzing them; KISA conducted a parallel technical analysis expected to take about one month.Directly confirmed; source URL is live and matches. - #15[confirmed][no action needed]in section: Law Enforcement Response
“The hack was one of several high-profile South Korean exchange incidents in 2018 — the same year the larger exchange Bithumb also suffered a significant breach — prompting calls for stricter regulation of domestic cryptocurrency platforms.”
reviewerThe same year, the larger exchange Bithumb also suffered a significant breach.Bithumb's 2018 hack is well documented and confirmed independently. - #16[confirmed][no action needed]in the summary
“Following the hack, Coinrail suspended trading operations and cooperated with South Korean law enforcement; the exchange subsequently transitioned to an offline platform and never fully resumed normal operations.”
reviewerCoinrail transitioned to an offline-only platform and never fully resumed normal operations.Directly confirmed by CoinMarketCap Academy article, which is live. - #18[confirmed][no action needed]in section: Operational Aftermath and Exchange Status
“Pundi X explicitly stated that Coinrail, not the token issuers, bore legal responsibility for the security failure, and declined to issue replacement tokens or execute a hard fork on behalf of affected users.”
reviewerPundi X stated that Coinrail, not the token issuers, bore legal responsibility for the security failure and declined to issue replacement tokens or a hard fork.Consistent with the primary source's framing of responsibility. - #19[confirmed][no action needed]in the timeline
“Coinrail detects a security breach affecting its hot wallets over the weekend. Approximately 30 percent of the exchange's token reserves — over $40 million at then-current prices — are stolen, including NPXS, ATX, DENT, ETH, and TRX. The exchange suspends all services.”
reviewerTimeline: On 2018-06-10 Coinrail detects the breach over the weekend, ~30% of reserves stolen (>$40M), exchange suspends services.Confirmed; source is live. - #20[confirmed][no action needed]in the timeline
“South Korean police formally launch an investigation, securing access logs from Coinrail's servers. The Korea Internet and Security Agency (KISA) begins a parallel technical review.”
reviewerTimeline: South Korean police formally launch an investigation on 2018-06-11, securing access logs; KISA begins parallel technical review.Confirmed. - #21[confirmed][no action needed]in the timeline
“The attacker attempts to liquidate stolen NPXS tokens on IDEX, a decentralized exchange. Pundi X requests and obtains an urgent suspension of NPXS trading on IDEX to prevent the sale.”
reviewerTimeline: On 2018-06-25 the attacker attempts to liquidate stolen NPXS on IDEX; Pundi X obtains an urgent suspension.Precisely matches the primary source. - #22[confirmed][no action needed]in the timeline
“Pundi X publishes a detailed update disclosing that it suspended the NPXS smart contract for 10 days at the request of Korean police, blocked monthly distributions to the hacker's wallet, and cooperated with the ongoing official investigation. Pundi X declines to issue replacement tokens, stating that Coinrail bears legal responsibility for the breach.”
reviewerTimeline: On 2018-06-27 Pundi X publishes a detailed update disclosing the 10-day smart contract suspension and declining to issue replacement tokens.Confirmed; publication date matches the cited URL's own dateline.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.