Unocoin detected unauthorized activity on its infrastructure on Nov. 6, triggering immediate "precautionary measures" to protect user funds. The exchange requested an immediate freeze of its enterprise accounts with Fireblocks and BitGo at 11:24 UTC and 11:29 UTC respectively. Both providers confirmed the freezes, and no losses were identified at that stage. However, more unauthorized activity appeared on Nov. 9, forcing Unocoin to suspend all services immediately in the interest of protecting customer assets and data. This included implementing a login suspension that has left customers unable to access their accounts since then.
Incomplete Visibility into BitGo Wallets
Unocoin discovered outgoing transactions from one of its Ethereum addresses in its BitGo wallet infrastructure on Thursday. It used this address to fund ERC-20 tokens, but the exchange cannot trace where the funds went because BitGo relies on change addresses for a significant part of its architecture. Consequently, Unocoin stated it currently does not have complete visibility into all potentially unintended transactions across its BitGo wallets. It escalated the matter to BitGo, which opened an investigation and confirmed the matter is being treated as a priority. The update provides no amount, transaction count, destination address, or cause for the transfers. Onchain Lens reported that Arkham shows $0 across 81,000 tracked Unocoin addresses, though the exchange has not confirmed its tracked wallets were drained.
Rebuilding Servers and Ongoing Investigation
Unocoin says more than 90% of customer cryptocurrency is held in cold storage, meaning wallets kept offline, and asserts that no user funds have been lost. When asked if those funds could be recovered, the exchange replied it would not give you an assurance based on assumptions until transaction-level details are verified. The company is rebuilding its servers from scratch, a process expected to take four to five working days, while its investigation into the breach and potential data exposure remains ongoing. It has not established the root cause of the compromise. This incident follows another at Indian exchange CoinDCX in October, which absorbed losses after a failed sweep of addresses compromised in its 2025 hack. Unocoin’s inability to log in to its frozen accounts creates a critical gap in verifying the full extent of the unauthorized activity.
