Unocoin says infrastructure was compromised, flags outgoing transactions from BitGo ETH wallet

In short

• Unocoin says it detected unauthorised activity on 6 and 9 November, froze its Fireblocks and BitGo accounts on 6 November, and suspended services on 9 November.
• On 12 November, Unocoin said it identified potentially unintended transactions from one ETH address in its BitGo wallet infrastructure.
• Unocoin claims more than 90% of customer crypto is in cold storage; the complete status of holdings remains under investigation.
• The four-to-five-working-day estimate is for rebuilding servers only.

Unocoin’s  12 November update disclosed for the first time that it had detected unauthorised activity on 6 November; earlier public messaging dated the incident to 9 November. In its 9 November post on X, Unocoin said it had identified unauthorised access to its servers, temporarily disabled user logins and said “no crypto funds have been lost.” The 12 November blog does not repeat that line and says the complete status of holdings and any potential exposure are still being investigated. An Unocoin reply at 15:19 IST said crypto withdrawals had been temporarily disabled before 9 November for system maintenance; after the blog, a 16:27 IST support reply again said no user funds had been lost and assets remained safe. These are Unocoin statements, not independent confirmation.

How did the Unocoin security incident unfold?

Unocoin says it detected unauthorised activity on Friday, 6 November 2026, and requested immediate freezes of enterprise accounts holding cryptocurrency required for day-to-day transactions: Fireblocks at 11:24 UTC and BitGo at 11:29 UTC. Unocoin says both providers confirmed the freezes and that cryptocurrency is not kept on its servers; at that point, it had identified no loss of crypto funds. After further unauthorised activity on Monday, 9 November, Unocoin suspended all services and later said its infrastructure had been compromised. The full extent, systems accessed, potential exposure, root cause and sequence remain under investigation.

What Unocoin found in its BitGo wallet

On 12 November, Unocoin said it identified “outgoing transactions that has happened from one of the ETH addresses in our BitGo wallet infrastructure, which we used to fund ERC-20 tokens.” The date is when Unocoin identified the transactions, not necessarily when they occurred. Unocoin called them potentially unintended transactions and said it escalated the matter to BitGo. According to Unocoin, BitGo has initiated a priority investigation; BitGo has made no public statement. Unocoin says its BitGo enterprise accounts remain frozen and it cannot log in to them. The exchange also says BitGo change addresses limit full on-chain checks, leaving it without complete visibility into all potentially unintended transactions across its BitGo wallets.

What the security incident means for Unocoin users

Unocoin says more than 90% of cryptocurrency held on behalf of customers is in cold storage; this is the exchange’s claim, not independently verified. It says it is still establishing the complete status of all holdings and investigating any potential exposure. The company has not established the root cause or the complete sequence of events.

What Unocoin users are asking on X

• Unocoin’s 12 November post says users deserve “facts, not speculation.” Its 9 November X post said no crypto funds had been lost; an Unocoin support reply at 16:27 IST on 12 November repeated a no-loss and safe-assets assurance after the blog omitted that line. The blog says the complete status of holdings and potential exposure remain under investigation.
• PrimeRadiant (@RDblaz3) said on X that the update still does not provide the full picture, asking how much of users' funds are at risk and whether 90% in cold wallets means users can be assured of getting at least 90% back.
• Amol modi (@aaditya00000001) said on X that Unocoin's language had shifted from unauthorised login to unauthorised transactions and asked who will be responsible if something happens.
• Skxrx (@0xskxrx) said on X that pausing logins while the servers get checked is the sensible move, adding that coins not being traded sit on keys that never had a login page to pause.

Unocoin’s key incident figures

Timeline of Unocoin’s security incident

• 6 Nov 2026: Unauthorised activity detected and BitGo and Fireblocks accounts frozen
• 9 Nov 2026: Further unauthorised activity and Unocoin suspended all services
• 12 Nov 2026: Unocoin published security update and found outgoing BitGo wallet transactions

Questions Unocoin users may have

Is customer crypto safe on Unocoin?

Unocoin’s 9 November post said “no crypto funds have been lost,” and a support reply after the 12 November blog repeated a no-loss assurance. The 12 November blog does not repeat that line; it says the exchange is still establishing the complete status of holdings and investigating potential exposure. Unocoin also claims more than 90% of customer cryptocurrency is maintained in cold storage. These are the company’s statements, not independent confirmation of the status of funds.

Why did Unocoin suspend all services?

Unocoin says it detected unauthorised activity on 6 November and requested freezes of its enterprise accounts with Fireblocks and BitGo that day. After further unauthorised activity on 9 November, it suspended all services and later said its infrastructure had been compromised. The exact root cause remains unknown.

When will Unocoin resume logins and withdrawals?

Unocoin estimates the server rebuild will take approximately four to five working days. The estimate covers only the rebuild, and security checks must happen before service restoration, so the company has not set a login or withdrawal restart date.

What should Unocoin users do after the security incident?

Users can follow Unocoin's official X account and blog for verified updates on the investigation and service restoration. Unocoin says it will share further updates as findings are established and the extent of impact is known.

Our view

At InvestIn.News, we think this update should be read as Unocoin’s own account, not as independent confirmation of the status of customer funds. The key change is that the 9 November post said “no crypto funds have been lost,” while the 12 November blog says the complete status of holdings is still being established and potential exposure is under investigation. Unocoin support’s later reply repeating a no-loss assurance should be attributed to the company, not read as independent confirmation. Neither BitGo nor Fireblocks had publicly commented as of about 16:45 IST on 12 November; the custody details remain based on Unocoin’s account. The four-to-five-working-day estimate concerns server rebuilding only, not a promised restart of logins or withdrawals. Any account of BitGo’s investigation comes from Unocoin; the next meaningful update would be its findings or a full holdings report from Unocoin.

How we reported this: This story draws on Unocoin’s 12 November security update, its official posts and replies on X, and selected public reactions. Claims about the incident, custody and holdings remain attributed to Unocoin.

Follow the latest short updates on NewsFeeds.

Ishu Aggarwal

What to watch: According to Unocoin, BitGo has started a priority investigation into potentially unintended transactions; Unocoin says it is still establishing the complete status of holdings and investigating potential exposure.