URGENT: Revoke your exchange API keys connected to Coinigy
Dear Coinigy customers,
We have confirmed that an unauthorized party accessed Coinigy systems this morning, November 12.
Exchange API keys and secrets stored on our platform may have been compromised. Treat any exchange API key you have provided to Coinigy as exposed and revoke it immediately.
Our investigation is ongoing. Coinigy is currently offline while we conduct a forensic investigation into the incident. We are notifying you now so you can take immediate steps to protect your exchange accounts.
We have not confirmed the unauthorized party's intentions or whether exchange credentials were copied or misused, so we are asking all users to revoke their connected API keys immediately as a precaution.
What you need to do now:
- Open each exchange's official website or app directly and go to its API management settings.
- Delete or revoke every API key you have connected to Coinigy that remains active on the exchange. This includes read-only keys and keys you previously removed from Coinigy.
- Review recent trades, open orders, positions, and withdrawals. If you see activity you do not recognize, contact the exchange's support team immediately and report it to Coinigy at support@coinigy.com.
Removing a key from Coinigy alone does not revoke it at the exchange. Changing your Coinigy password is also not a substitute for revoking your exchange API keys.
If you choose to rotate your keys, make sure the old keys are fully revoked. Do not connect replacement keys to Coinigy until we confirm it is safe to do so.
Why this is urgent:
Even when withdrawals are disabled as we've instructed, a compromised API key with trading permissions can allow an attacker to place unauthorized trades even when withdrawals are disabled. Attackers can exploit low-volume markets to execute trades at manipulated prices, potentially causing substantial losses or draining an account through trading alone.
Please take these steps even if you have not noticed suspicious activity or no longer use Coinigy. You do not need to access Coinigy to revoke keys directly on your exchanges.
We are sorry for this incident and the concern and disruption it causes. We will provide further updates as we verify additional information. Please do not wait for another update before revoking your keys.
For your protection, do not send API keys, API secrets, passwords, or authentication codes by email or message.
The Coinigy Team