Unocoin: compromised infrastructure halts all services; unexplained BitGo outflows under review
Severity: high · Patch status: no-fix-needed · Since 2026-11-09
Unocoin, an Indian crypto exchange, says in its own 12 November update that unauthorised activity was first detected on 6 November, when it froze its enterprise custody accounts at BitGo and Fireblocks. Further unauthorised activity on 9 November led it to suspend all services after finding its infrastructure had been compromised. It is rebuilding its server infrastructure from the ground up (estimated at 4 to 5 working days) and has not established the root cause. On 12 November it identified outgoing transactions from one ETH address in its BitGo wallet infrastructure, which it had used to fund ERC-20 tokens. BitGo is investigating, the BitGo accounts remain frozen, and Unocoin says it does not yet have full visibility into all potentially unintended transactions across its BitGo wallets, so the total amount is unknown. It says more than 90% of customer crypto is held in cold storage and that no loss had been identified at the time of its 6 November measures. It does not state that customer funds were lost or that customer data was accessed; it says the information potentially exposed is still under investigation. The figure of about 81,000 addresses showing zero holdings comes from third-party blockchain analytics (Onchain Lens and Arkham, as reported by Cryptometer). Unocoin's notice does not address it, and no source establishes whether it reflects theft or a display problem. Reports conflict on the website: one says a 504 gateway error, another a scheduled-maintenance page; Unocoin's notice describes suspended services.
What to do
- If you are an Unocoin customer, assume your credentials and account data may be exposed (Unocoin says the information potentially exposed is still under investigation); change your password and re-secure 2FA once logins return
- Once access is restored, check your balances and transaction history with Unocoin; treat the 81,000 zero-holdings figure as an unverified third-party observation and raise any discrepancy through Unocoin's support ticket portal
- Monitor Unocoin's blog (blog.unocoin.com) for the further updates it has promised, and verify any recovery or support message against it before acting
- Beware of phishing targeting users during the outage
- Organizations with funds or trading exposure on Unocoin: its BitGo and Fireblocks accounts are frozen and the extent of unintended outflows is unknown; ask Unocoin for written confirmation of holdings before deciding on any withdrawal or transfer
- Watch for stolen Unocoin customer data surfacing in credential dumps
Sources
All live incidents on Threat Watch
