Indian crypto exchange Unocoin said Thursday that it found outgoing transactions from one of its Ethereum (ETH) addresses in its BitGo wallet infrastructure, an address it used to fund ERC-20 tokens (tokens issued on Ethereum under a common standard). It disclosed the finding in an update to its incident post, three days after suspending all services.
Unocoin said it escalated the matter to BitGo, a custody provider (a firm that holds and secures crypto on behalf of clients), and that BitGo opened an investigation into how the transactions were executed. According to Unocoin, BitGo “confirmed that the matter is being treated as a priority.” Unchained found no public statement from BitGo.
The update gives no amount, transaction count, destination address or cause.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
What Unocoin Says It Can’t See
Unocoin said its BitGo enterprise accounts remain frozen and it cannot log in to them. It said in the update that BitGo relies on change addresses, fresh addresses a wallet creates to hold the leftover balance from a transaction, for “a significant part” of its wallet architecture, so the exchange cannot fully trace the activity on the blockchain either. The exchange wrote that “we currently do not have complete visibility into all potentially unintended transactions across our BitGo wallets.” It said it has asked BitGo for transaction-level details.
The post also said more than 90% of the crypto Unocoin holds for customers is in cold storage, meaning wallets kept offline. It did not say whether any user balances were affected.
How the Incident Unfolded
Unocoin said it detected unauthorized activity on Friday, Nov. 6, and asked the two service providers that hold its day-to-day crypto balances to freeze its enterprise accounts: Fireblocks at 11:24 UTC and BitGo at 11:29 UTC. Both confirmed, and no losses had been identified then, it said. After more unauthorized activity on Monday, Nov. 9, it suspended all services, and its investigation found its infrastructure “had been compromised.” It is rebuilding its servers from scratch, which it expects to take about four to five working days, and has not established the root cause.
Unocoin’s disclosure follows another incident at an Indian exchange: in October, CoinDCX said it absorbed losses after a failed sweep of addresses compromised in its 2025 hack.
Unchained’s Read
On X, Unocoin told users on Nov. 9 that no crypto funds had been lost, and wrote in a Thursday reply, posted about two and a half hours before its blog update was last revised, that “no user funds have been lost.” That blog update says Unocoin cannot log in to its BitGo accounts and lacks complete visibility into their transactions, and puts no figure on what left them.
Related Listen: Why One Infected Laptop Led to the Largest Hack in History
