TheBlock
Indian exchange Unocoin has identified outgoing transactions from an ETH address in its BitGo wallet infrastructure, a new escalation in a security incident that has kept customers locked out since Nov. 9. The exchange first detected unauthorized activity on Nov. 6 and immediately requested a freeze of its enterprise accounts with BitGo and Fireblocks, which hold the balances used for day-to-day transactions. It discovered the latest activity on Thursday and escalated to BitGo, which has opened an investigation. On Monday, after more unauthorized activity surfaced, Unocoin suspended all services, including logins.
Why it matters
Unocoin says more than 90% of customer cryptocurrency sits in cold storage and that no funds were lost. But when a user asked on X whether those funds could be recovered, the exchange declined, saying it would not "give you an assurance based on assumptions" until transaction-level details are verified.
The exchange also admits it cannot log in to the frozen accounts, and that BitGo's use of change addresses limits what it can verify on-chain. "We currently do not have complete visibility into all potentially unintended transactions across our BitGo wallets," it wrote in its incident report.
Market impact
Onchain Lens reported that Arkham shows $0 across 81,000 tracked Unocoin addresses and that the exchange's website returned a 504 error, though Unocoin has not confirmed its tracked wallets were drained. Unocoin estimates rebuilding its servers from the ground up will take four to five working days. The probe into the breach, potential data exposure, and the status of user holdings remains ongoing, and the incident lands as a fresh custody-trust test for one of India's longest-running regulated exchanges.
Frequently asked questions
-
Are Unocoin customer funds lost?
Unocoin says more than 90% of customer cryptocurrency is held in cold storage and that no funds were lost. It declined to give a recovery assurance, however, saying it would not "give you an assurance based on assumptions" until transaction-level details are verified.
-
Why did Unocoin suspend logins?
The exchange detected additional unauthorized activity on Monday, Nov. 9, and suspended all services, including logins, in the interest of protecting customer assets and data. Customers have been unable to access accounts since then.
-
What did Unocoin find in its BitGo wallets?
It identified outgoing transactions from an ETH address in its BitGo infrastructure and escalated the matter to BitGo, which opened an investigation. Unocoin says it does not have complete visibility into all potentially unintended transactions across its BitGo wallets.
-
When will Unocoin services be restored?
Unocoin estimates rebuilding its servers from the ground up will take four to five working days. The investigation into the breach, potential data exposure, and the status of user holdings remains ongoing.
-
What role do the Fireblocks accounts play?
Unocoin's enterprise accounts with BitGo and Fireblocks hold cryptocurrency balances required to facilitate its day-to-day crypto transactions. The exchange requested an immediate freeze of both on Nov. 6 after detecting unauthorized activity on its infrastructure.
WuBlockchain
CryptoSlate
CoinTelegraph
Lookonchain