Unocoin ‘login suspension’ continues as exchange flags outgoing BitGo ETH transactions

Indian cryptocurrency exchange Unocoin has identified "outgoing transactions" from an ETH address in its BitGo wallet infrastructure, adding a new development to a security incident that has left customers unable to access their accounts since Nov. 9.

In its latest statement, the exchange said it discovered the activity on Thursday and immediately escalated the matter to BitGo, which has opened an investigation.

The exchange said the incident traces back to Nov. 6, when it first detected unauthorized activity on its infrastructure and initiated "precautionary measures'' to protect user funds.

"As part of these measures, we requested an immediate freeze of our enterprise accounts with BitGo and Fireblocks, which hold cryptocurrency balances required to facilitate our day-to-day crypto transactions," the exchange wrote.

The incident took another turn on Monday, when the exchange said it detected more unauthorized activity on its platform and suspended all services immediately in the "interest of protecting customer assets and data." This included implementing what it described as "login suspension."

Unocoin user funds

Unocoin says more than 90% of customer cryptocurrency is held in cold storage and that no funds were lost in the incident. However, when asked by a user on X whether those could be recovered, the exchange replied that it would not "give you an assurance based on assumptions" until transaction-level details are verified.

The exchange also said it cannot log in to the frozen accounts and that BitGo's use of change addresses limits what it can check on-chain.

"We currently do not have complete visibility into all potentially unintended transactions across our BitGo wallets," it wrote in the incident report.

Unocoin said rebuilding its servers from the ground up would take an estimated four to five working days. The investigation into the breach, potential data exposure, and status of user holdings remains ongoing.

Meanwhile, Onchain Lens reported that Arkham shows $0 across 81,000 tracked Unocoin addresses and that the exchange's website returned a 504 error. The exchange has not confirmed that its tracked wallets were drained.