Unocoin Detects Unauthorised Wallet Transactions After Security Breach, Suspends Services

Cryptocurrency exchange Unocoin has suspended its services after detecting unauthorised access to its servers, with the company later identifying outgoing transactions from an Ethereum (ETH) address linked to its BitGo wallet infrastructure.

Unocoin said it detected suspicious activity on November 6, 2026, followed by further unauthorised activity on November 9. On November 12, it identified outgoing transactions from one of its Ethereum addresses used to fund ERC-20 tokens.

Unocoin Reports Unauthorised Transactions From BitGo Wallet

Unocoin said it escalated the November 12 finding to BitGo, which initiated an investigation into how the transactions could have been executed. The exchange said its BitGo enterprise accounts remain frozen and it cannot currently access them. It also said BitGo’s wallet architecture uses change addresses while processing transactions, making it difficult to establish the complete transaction activity through Blockchain records.

Unocoin has requested transaction-level details and clarification from BitGo. It said more than 90 per cent of the cryptocurrency funds held on behalf of customers are maintained in cold storage. The company is working with its infrastructure and custody partners to establish the complete status of its cryptocurrency holdings and investigate any potential exposure.

Unocoin Suspends Services After Server Access Incident

Unocoin said it requested freezes of its enterprise accounts with BitGo and Fireblocks after detecting suspicious activity on November 6. The accounts hold cryptocurrency balances used for its day-to-day transactions. The freeze requests were initiated at 11:29 UTC for BitGo and 11:24 UTC for Fireblocks, and both providers confirmed the freezes. At that time, the company had not identified any loss of cryptocurrency funds.

On November 9, after detecting further unauthorised activity, Unocoin suspended all its services and temporarily disabled user logins. The company said its infrastructure had been compromised, but the exact cause, systems accessed and information potentially exposed were still under investigation.

Unocoin decided to rebuild its entire server infrastructure from the ground up instead of restoring the existing environment. It estimated that the process would take around 4-5 working days. The company said services would resume after the investigation and necessary security measures were completed.