Unocoin now says the breach that has kept its customers locked out began on Nov. 6, three days earlier than it first disclosed, and that it found outgoing transactions on Thursday from an Ethereum address in its BitGo wallet setup. The Bengaluru exchange has not said how much left that address. It also says it cannot yet see the full picture, because its BitGo accounts are frozen and it cannot log in to them.
A new timeline
The details are in a security incident update Unocoin published on its blog and shared with users on Thursday. It goes well beyond the short Nov. 9 notice, which said the exchange had identified unauthorised access to its servers that day.
According to the update, Unocoin detected unauthorised activity on Friday, Nov. 6, and immediately asked its two custody providers to freeze its enterprise accounts. It gives the request times as 11:24 UTC for Fireblocks and 11:29 UTC for BitGo, and says both firms confirmed the freezes. Those accounts hold the balances Unocoin uses for its day-to-day crypto transactions. The exchange says it does not keep cryptocurrency directly on its own servers, and that no loss had been identified at the time.
The intrusion was not over. Unocoin says that despite rechecking and strengthening “several apparent and assumed vulnerabilities,” it detected further unauthorised activity on Monday, Nov. 9, and suspended all services. Its investigation then established that its infrastructure had been compromised. Which systems were accessed, and what data may have been exposed, is still under investigation, and the root cause has not been found.
The BitGo finding
The most serious new line concerns Thursday. Unocoin says it identified outgoing transactions from one of the ETH addresses in its BitGo wallet infrastructure, an address it used to fund ERC-20 tokens. It escalated the finding to BitGo, which it says has opened an investigation into how the transactions could have been executed and is treating the matter as a priority.
The exchange lists three reasons it cannot yet size the problem. Its BitGo enterprise accounts remain frozen. It cannot log in to them. And much of BitGo’s wallet design relies on change addresses, so Unocoin says it cannot fully trace activity on the blockchain either. On Bitcoin-style networks, a wallet sends leftover funds from each payment to a fresh change address, which makes a custodial wallet’s total hard to rebuild from public data alone. Unocoin says it has asked BitGo for transaction-level details.
BitGo had not commented publicly on Unocoin when we checked on Thursday.
Mixed messages to users
The update stops short of the blanket assurance Unocoin had been giving. Its Nov. 9 post said “no crypto funds have been lost.” The new document says only that no loss had been identified when the accounts were first frozen, and that more than 90% of crypto held for customers sits in cold storage.
Replies from the exchange’s X account have not all caught up. About half an hour after it shared the update on X, Unocoin told one user that “no user funds have been lost and your assets remain safe.” Later, asked whether customers could count on getting at least 90% back, it took a more careful line. “Until we receive and verify the complete transaction-level details, we don’t want to give you an assurance based on assumptions,” Unocoin said, adding that it would share verified figures once they were established.
In another reply, the exchange said the initial unauthorised activity was detected on its servers on Nov. 6, and the outgoing BitGo transactions were found separately on Nov. 12.
The new dates also sit awkwardly with an earlier explanation. Earlier on Thursday, Unocoin told a user that before Nov. 9, only crypto withdrawals were off, because of “ongoing system maintenance,” as we reported in our earlier story on the withdrawal pause. The update shows the custody accounts behind daily crypto transactions were frozen on Nov. 6 because of suspicious activity. Unocoin has not said whether those freezes are what stopped withdrawals, or when the maintenance pause began. Its website still showed a “Scheduled Maintenance” page on Thursday, with no mention of the incident.
What comes next
Unocoin says it is rebuilding its entire server infrastructure from scratch rather than restoring the old environment, and estimates that will take about four to five working days. Services will return only after security checks, it says. It has not set a date.
Several questions remain open. Unocoin has not said how much moved out of the BitGo address or where it went, whether the transactions were signed with keys or credentials taken in the breach, or whether the share of customer crypto held outside cold storage is enough to cover any shortfall. BitGo’s findings will likely settle most of that.
For now, customers should rely only on Unocoin’s blog and its verified X account, and treat anyone offering to recover funds or asking for login codes as a likely scammer.
FAQ
When did the Unocoin breach start?
Unocoin says it first detected unauthorised activity on Nov. 6, froze its BitGo and Fireblocks accounts that day, and suspended all services after more activity on Nov. 9.
Has Unocoin lost customer funds?
It has not said. It found outgoing transactions from one BitGo ETH address on Nov. 12 but cannot yet measure them, and says more than 90% of customer crypto is in cold storage.
When will Unocoin reopen?
The exchange estimates the server rebuild will take four to five working days, followed by security checks. It has given no firm date.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
