Unocoin Hack November 2026: Unauthorized ETH Transfers From BitGo Wallet in India — What Users Should Do
Image: Unocoin logo — Wikimedia Commons / Kittusiva (official company logo)
📌 Key Highlights
- Unocoin detected unauthorised activity on 6 November 2026 and froze its Fireblocks and BitGo enterprise accounts the same day.
- Further unauthorised activity on 9 November forced a full suspension of all services; the exchange later confirmed its infrastructure was compromised.
- On 12 November, Unocoin found outgoing transactions from one ETH address in its BitGo wallet, used to fund ERC-20 tokens — BitGo is now investigating as a priority.
- More than 90% of customer crypto funds are held in cold storage, Unocoin says; no confirmed loss amount has been published.
- Services remain suspended for a fourth day, with a full server rebuild estimated at 4–5 working days.
What happened?
Unocoin published a detailed security update on its official blog on 12 November 2026, laying out a six-day timeline. The exchange first spotted suspicious activity on Friday, 6 November. Within hours it asked custodians BitGo and Fireblocks to freeze its enterprise accounts — Fireblocks at 11:24 UTC and BitGo at 11:29 UTC — and received confirmation from both that no further transactions could be initiated. At that point, Unocoin said, no loss of cryptocurrency funds had been identified, and it stressed that cryptocurrencies are not kept on its own servers directly.
Then the situation worsened. Despite rechecking and strengthening what it believed were the weak points, Unocoin detected further unauthorised activity on Monday, 9 November, and immediately suspended all services to protect customer assets and data. Its investigation has since established that its infrastructure was compromised, although the root cause, the systems accessed and any data potentially exposed are still being investigated.
| Date | What Unocoin confirmed |
|---|---|
| 6 Nov 2026 | Unauthorised activity detected; Fireblocks and BitGo enterprise accounts frozen (11:24 / 11:29 UTC); no loss identified at the time |
| 9 Nov 2026 | Further unauthorised activity detected; all Unocoin services suspended; infrastructure later confirmed compromised |
| 12 Nov 2026 | Outgoing transactions found from one ETH address in the BitGo wallet used to fund ERC-20 tokens; BitGo investigating as a priority |
| Next 4–5 working days | Entire server infrastructure being rebuilt from scratch before services resume |
The newest finding is the most serious. On 12 November, Unocoin identified outgoing transactions from one of the ETH addresses in its BitGo wallet infrastructure — the address it used to fund ERC-20 tokens. It escalated the finding to BitGo immediately, and BitGo has confirmed the matter is being treated as a priority. But Unocoin is blunt about its own blind spot: the BitGo accounts are still frozen, it cannot log in to them, and BitGo's wallet architecture uses change addresses, so the exchange cannot fully verify on-chain what moved. It has asked BitGo for transaction-level details and says it will share more once the facts are verified.
Illustrative image: Bitcoin logo — Wikimedia Commons. Unocoin says over 90% of customer funds are held in cold storage.
Why it matters for India readers
Unocoin is India's oldest centralised crypto exchange, founded in 2013, and its users have now been locked out for four days with no date for trading or withdrawals to resume. The 12 November finding changes the picture: this is no longer only a server intrusion with services paused as a precaution — money appears to have moved out of a custodial wallet after the account was supposedly frozen. How that was possible is exactly what BitGo's investigation must answer, and it is the question every Indian exchange customer will be asking.
There is also an important honesty check. Unocoin's 9 November statement said "no crypto funds have been lost". That assurance predates the 12 November discovery, and the new update does not repeat it — it says the complete extent of the BitGo transactions cannot yet be established. Separately, blockchain analytics account Onchain Lens flagged Arkham Intelligence data showing roughly 81,000 Unocoin-linked addresses at zero balance. That figure is explicitly unconfirmed: a balance snapshot alone cannot prove theft, and no independent investigator has linked the empty wallets to the breach. Do not treat the $0 figure as a confirmed loss.
The incident also fits a wider pattern Indian regulators have been warning about. CERT-In's "Crafty Falcon" advisory (CIAD-2026-0058, 4 November) described AI-assisted attacks on Indian banks, fintech firms and crypto exchanges, including wallet-key theft — and the Chainstack breach disclosed this week also involved an AI agent framework. For Indian crypto users, the lesson is the same one regulators keep repeating: custodial risk is real, and an exchange's assurances are only as good as its key management.
What Unocoin users should do now
Unocoin says it will publish findings once the investigation establishes them. Its listed support contacts are support@unocoin.com and helpline 7788978910 (09:30 AM–06:30 PM IST, Monday–Saturday). Until services resume, users cannot log in, trade or withdraw — and the 4–5 working day rebuild estimate means the lockout is likely to stretch into next week.
FAQs
Has Unocoin been hacked?
Yes — Unocoin has confirmed unauthorised access to its servers and that its infrastructure was compromised. It detected the first activity on 6 November, suspended all services on 9 November, and on 12 November found unauthorised outgoing transactions from its BitGo wallet. The root cause and full scope are still under investigation.
Has any customer money been lost?
No loss amount has been confirmed. Unocoin said on 9 November that no crypto funds had been lost, but its 12 November update says it cannot yet establish the complete extent of the BitGo wallet transactions. The widely shared figure of 81,000 addresses showing zero balance comes from Arkham data and is unconfirmed — it does not by itself prove theft.
When will Unocoin services resume?
Not yet known. Unocoin is rebuilding its entire server infrastructure from scratch, which it estimates will take approximately 4–5 working days, followed by security checks and validation before any services are restored. No reopening date has been announced.
Is my crypto safe if it was on Unocoin?
Unocoin says more than 90% of customer cryptocurrency funds are held in cold storage, which is not connected to the compromised servers. But the exchange has not yet confirmed the complete status of all holdings, and the BitGo wallet transactions are still being investigated — so customers should follow only official updates and keep their own transaction records.
Takeaway: Unocoin's own update confirms the breach is worse than first disclosed — money moved from a frozen custodial wallet, and the exchange cannot yet say how much. Until BitGo's investigation and the server rebuild conclude, Indian users should rely only on Unocoin's official channels and treat every loss figure circulating online as unconfirmed.
Read our earlier coverage of India's biggest recent breach — the SBI customer data leak — and the GitHub CI secret-stealer attack that hijacked 4,837 accounts this week. The TSMC employee data leak is another reminder that even the world's biggest tech companies are being hit through third-party vendors.
Sources
- Unocoin — Security Incident Update – Unocoin 12 NOV (official blog, 12 November 2026)
- KuCoin News — Unocoin Discovers Unauthorized ETH Transfers from BitGo Wallet (12 November 2026)
- Blockonomi — Unocoin Users Locked Out for Fourth Day as Exchange Stays Silent on Empty Wallets (12 November 2026)
- CoinScreamer — Unocoin Breach Raises Questions After $0 Wallet Report (12 November 2026)
Comments
Post a Comment