At a glance
- On 12 Nov Unocoin spotted ETH leaving an address held in its BitGo wallets, six days after asking BitGo to freeze its account, the exchange said in a security incident update. It has not said how much moved.
- Users have been unable to log in since 9 Nov. The exchange is rebuilding all of its servers, a job it puts at four to five working days.
Unocoin said the transfers came from an ETH address it used to fund ERC-20 tokens, the standard for tokens issued on Ethereum, and that it has escalated the finding to BitGo.
“BitGo has confirmed that the matter is being treated as a priority, and we are awaiting their findings,” the exchange said. It shared the update on X at 10:44 UTC (16:14 IST) on Thursday.
The timeline so far
According to the update, Unocoin detected unauthorised activity on its systems on Friday 6 Nov. It asked its two custody providers to freeze its enterprise accounts: Fireblocks at 11:24 UTC (16:54 IST) and BitGo at 11:29 UTC (16:59 IST). Both confirmed the freezes, it said.
A custody provider holds the keys to an exchange’s working crypto balances, which is what a crypto custodian does. Unocoin says it keeps no crypto directly on its own servers, and that it had not found any loss when the freezes were put in place.
On Monday 9 Nov it detected further unauthorised activity and suspended all services, including logins. Before that, only crypto withdrawals had been paused, “due to ongoing system maintenance”, the exchange said in a reply on X.
Its investigation has since found that its infrastructure was compromised. The root cause, which systems were reached and what customer data may have been exposed are still being investigated.
What Unocoin says about funds
Unocoin says more than 90% of the crypto it holds for customers is in cold storage, wallets kept offline.
It also says it cannot yet see the full picture. Its BitGo accounts remain frozen, it cannot log in to them, and BitGo’s use of change addresses, fresh addresses that receive the leftover from each transaction, means it cannot fully trace activity on-chain either.
“We currently do not have complete visibility into all potentially unintended transactions across our BitGo wallets,” the update says.
Its messages to users have differed. On 9 Nov the exchange said on X that “no crypto funds have been lost”, and one reply on Thursday, after the update was posted, repeated that no user funds had been lost. In another reply about half an hour later, it said it would not give users an assurance “based on assumptions” until transaction-level details are verified.
On-chain tracker Onchain Lens said Arkham’s explorer showed a zero balance across about 81,000 addresses it attributes to Unocoin, The Block reported. Unocoin has not confirmed that its wallets were emptied. This has not been independently confirmed by CryptoWatchDesk.
BitGo, the US custodian that reported its third-quarter results this week, had not published its own statement on the transactions as of 21:00 UTC on Thursday, as far as we could find.
What we don’t know yet
Unocoin has not said how much ETH or how many tokens left the address, where they went, or how they could move from an account it says was frozen. It has not said whether customer data was exposed, or given a date for logins to return.
The incident comes the same day South Korea said on Thursday it will let exchanges freeze withdrawals when a hack is only suspected, an approach meant to stop losses early. Unocoin’s case shows the limit: a freeze is only as strong as the custodian enforcing it.
Why it matters: Unocoin’s customers cannot reach their crypto or rupee balances, and the exchange cannot yet say whether all of their crypto is intact. Users should rely only on Unocoin’s official blog and X account, and treat unsolicited “recovery” offers as likely scams.
Next, watch for BitGo’s findings on the transactions and Unocoin’s account of how much moved, which it says it will publish once verified.
This article is for information only and is not investment advice.