Unocoin, one of India’s oldest crypto exchanges, said on Thursday 12 November that it had found outgoing ether transactions from an Ethereum address inside its BitGo wallet setup, six days after it first spotted unauthorised activity on its systems. In a security incident update on its blog, the Bengaluru company said its own server infrastructure had been compromised, that BitGo has opened an investigation, and that BitGo is investigating. The update gives no amount and no destination for the ether. Customers have been unable to log in since Monday 9 November.
The wording matters here. Unocoin says its servers were compromised. The address in question sits in Unocoin’s wallet infrastructure at BitGo, a custody provider, and was used to fund ERC-20 token transfers. Nobody, Unocoin included, has said BitGo itself was breached, and no theft has been shown on the blockchain so far. What exists is a company account of events, a frozen exchange and a gap in what the company can see.
Unocoin hack timeline: from a first alert on 6 November to the BitGo transactions
Unocoin’s update lays out the sequence with unusual precision for the first day and much less for the days after it.
| Date (2026) | What Unocoin reports |
|---|---|
| Friday 6 November | Unauthorised activity detected; Unocoin starts precautionary measures on its crypto holdings |
| 6 November, 11:24 UTC | Freeze of its Fireblocks enterprise account initiated |
| 6 November, 11:29 UTC | Freeze of its BitGo enterprise account initiated; both providers confirm the freezes |
| Monday 9 November | Further unauthorised activity despite earlier checks; all services suspended; infrastructure found to be compromised |
| Thursday 12 November | Outgoing transactions found from one ETH address in its BitGo wallets; matter escalated to BitGo |
At the time of the 6 November freezes, the company wrote, no loss of crypto had been identified. The post does not give times for the events of 9 November, and it does not say when the outgoing ether transactions took place, only when Unocoin found them.
What Unocoin says and what it cannot see
The most important sentence in the update is an admission. “We currently do not have complete visibility into all potentially unintended transactions,” Unocoin wrote, referring to its BitGo wallets. Its BitGo accounts remain frozen and it cannot log in to them, which is the point of a freeze but also means it cannot inspect them from the inside.
It cannot fully check from the outside either. Unocoin says BitGo’s wallet design uses change addresses, fresh addresses that receive what is left over after a payment, so the company cannot match every movement on the blockchain to its own wallets with certainty. It has asked BitGo for transaction-level details. According to The Block, Unocoin also declined on X to give customers an assurance of recovery “based on assumptions” until those details are verified.
BitGo, Unocoin says, has confirmed that it is treating the matter as a priority and is looking at how the transactions could have happened. That is Unocoin’s description of BitGo’s position. BitGo has published no statement of its own on the incident.
The “no funds lost” claim comes from Unocoin alone
The “no funds lost” line dates from Unocoin’s first statement after the 9 November suspension, relayed on X, in which it said no cryptocurrency funds had been lost, as Bitcoin.com News reported. Trade outlets such as Crypto Briefing and The Block still describe that as the exchange’s position. The 12 November blog post is more careful and does not repeat it. It says only that no loss had been identified when the first freezes were put in place, and that the full extent of unintended transactions at BitGo is not yet known.
Those two positions can both hold for now, but the second limits the first. A company that says it cannot see all its wallet activity can state that it has found no loss. It cannot yet show that there is none, and the latest update does not try to.
The exchange’s main reassurance is structural. “Cryptocurrencies are not kept on any of our servers directly,” the update says, and more than 90% of the crypto it holds for customers sits in cold storage, meaning keys kept offline (see our cold wallet explainer). That leaves up to a tenth outside cold storage. Unocoin does not say how large that share is in dollars, where it sits, or whether the ETH address was part of it.
What the chain shows, and what it does not
No ETH address, transaction hash, amount or token name appears in Unocoin’s update, and none has been published elsewhere. Until one is, the outflow cannot be traced on a block explorer and its size is unknown.
The only on-chain reading so far is indirect. The analytics account Onchain Lens said on X on 12 November that Arkham Intelligence shows a combined balance of $0 across about 81,000 addresses it attributes to Unocoin. Bitcoin.com News looked at the same Arkham page: 80,986 addresses, the label “No assets found”, a few hundred dollars at most over the past month and a three-month peak just above $250,000.
That history matters more than the zero. Labelled addresses that held a few hundred dollars for a month cannot be where the exchange keeps its customers’ coins, so an empty total says little about a drain. Arkham’s tags may simply be old, or may cover deposit addresses swept elsewhere. Bitcoin.com News made the same point: a zero balance on labelled wallets does not prove that funds were stolen, and no large theft has been independently verified.
BitGo and Fireblocks: two frozen accounts, one investigation
Unocoin used two institutional custody providers in parallel. Fireblocks, which relies on multi-party computation to split signing keys (our guide to Fireblocks explains the model), confirmed the freeze of Unocoin’s enterprise account on 6 November; the update reports nothing further from that side. All the questions now point to BitGo, which reported its third-quarter results on 10 November and has not commented on Unocoin.
A client’s compromised servers and a custodian’s own security are separate matters. If an attacker held working credentials or API access from inside Unocoin, a transaction could leave a custodied wallet without any fault at the custodian. Whether that is what happened, or whether the outgoing transactions came before the 6 November freeze, Unocoin does not say. BitGo’s findings should answer both points.
Rebuilding from scratch: four to five working days, no restart date
Rather than restore the existing environment, Unocoin says it will rebuild its whole server infrastructure from the ground up with enhanced security controls, which it expects to take four to five working days. Services resume only after security checks. The update does not say when the rebuild started, and it gives no reopening date. On 12 November its website returned a 504 error, according to Crypto Briefing and The Block.
How its systems were entered, which ones were accessed and whether customer information was exposed are all, in the company’s words, still under investigation. The update names no regulator or police complaint, and it gives customers no instructions; it lists a phone line open 09:30 to 18:30 India time, Monday to Saturday, an email address and a support ticket form.
An Indian exchange incident again, after WazirX and CoinDCX
Unocoin was founded in 2013 and is not new to security trouble. In June 2017 it blocked logins and withdrawals after a server flaw was found on 23 June, ForkLog reported at the time, with its chief executive saying customer funds were not at risk.
The larger Indian cases came later. In July 2024 WazirX put its losses from an attack on one of its multisig wallets at more than $230 million, The Record reported; the analytics firm Elliptic linked the attack to hackers tied to North Korea. In July 2025 CoinDCX disclosed a loss of about $44 million from a company account used only for liquidity on a partner exchange, and said its reserves would cover it in full and that no customer assets were affected, according to The Week. In October 2026 CoinDCX also confirmed a $16 million USDT loss from retired wallets.
In September 2025 India’s Financial Intelligence Unit (FIU-IND), where crypto platforms register for anti-money-laundering purposes, began to require cybersecurity audits by auditors empanelled with CERT-In, the national computer emergency team, in a circular dated 15 September 2025, Business Standard reported.
A closer parallel is South Korea’s Gopax, which halted withdrawals and trading on 6 November after a hacking threat, also with no loss reported and no restart date.
What Unocoin customers can do while logins are down
Unocoin’s update gives no advice, so these are general precautions for anyone locked out of an exchange after a breach. They are not steps the company has asked for.
- Treat any SMS, email or Telegram message about “fund recovery”, “KYC re-verification” or early access as suspect. Exchange incidents draw phishing, and Unocoin has not ruled out that customer data was exposed.
- Use only the contacts listed on blog.unocoin.com and unocoin.com, and never share a password or one-time code with anyone who calls.
- Change any password you used on Unocoin and on other sites, and turn on app-based two-factor authentication where you reused it.
- Keep your own records: screenshots of balances, deposit and withdrawal history, and any emails from Unocoin. They will help if there is a claims process later.
What is still unknown about the Unocoin breach
- How much ETH, or which ERC-20 tokens, left the BitGo address, when, and to which destination.
- Whether any customer balances are affected, and whether the “no funds lost” position survives BitGo’s transaction-level report.
- How Unocoin’s servers were compromised, and whether customer data was taken.
- Which Indian authorities, if any, have been notified.
- When logins, trading and withdrawals reopen once the four-to-five-day rebuild ends.
The next fact to watch is BitGo’s finding on the outgoing transactions, which Unocoin says it is waiting for before it gives any assurance on recovery.