Indian cryptocurrency exchange Unocoin halted all services on November 9, 2026, following unauthorized server access detected on November 6. Despite requesting enterprise account freezes from custodians BitGo and Fireblocks, Unocoin identified suspicious Ethereum transfers on November 12. BitGo reported that its systems were not breached, explaining that the transfers bypassed provider controls via Unocoin's user and backup recovery keys.
Incident timeline and Unocoin response
- ▪Unocoin suspended all platform services, including user account logins
- ▪On November 6, 2026, Indian cryptocurrency exchange Unocoin detected unauthorized access to its platform servers and initiated precautionary security measures
- ▪Unocoin initiated a complete rebuild of its server infrastructure, estimating that restoring platform services would take four to five working days
Unauthorized transactions and asset safety
- ▪Unocoin identified unauthorized outgoing Ethereum transfers from a BitGo wallet address used to fund ERC-20 tokens
- ▪Unocoin stated that it lacks full visibility into all wallet transactions due to the architectural complexity of BitGo change addresses
- ▪Unocoin reported that over 90% of customer cryptocurrency assets are held in offline cold storage wallets
- ▪Blockchain analytics firm Arkham Intelligence reported approximately 81,000 Unocoin-associated wallet addresses showing a combined balance of $0 on November 12, 2026
Freeze requests and BitGo multisignature security
- ▪BitGo's 2-of-3 multisignature arrangement requires two signatures among a user key, a backup key, and a BitGo key to approve wallet transactions
- ▪BitGo stated that enterprise account freezes apply only to activity routed through BitGo's platform and cannot block transactions signed externally with backup keys
- ▪BitGo's recovery mechanism permits transactions signed with both the user key and backup key to bypass provider withdrawal policies without BitGo's key
- ▪Unocoin investigated whether suspected misuse of a multisignature backup recovery mechanism enabled unauthorized transfers outside BitGo's control
Story comments
Loading comments…