Unocoin, one of India's oldest crypto exchanges, has kept deposits, withdrawals and logins suspended since Monday 9 November, after finding unauthorised activity on its servers and, later, outgoing transactions from a wallet in its BitGo custody setup. The exchange has not said when it will reopen.

It has, though, published its own account of what happened, timed to the minute at the start. That account points at an unusual suspect: a backup route built into BitGo's multisignature wallets, designed to return funds to their holder if the custodian ever disappears.

  • The news: Unocoin suspended all services on 9 November 2026 after detecting further unauthorised activity, and they remain suspended.
  • The figure: Unocoin asked Fireblocks and BitGo to freeze its enterprise accounts five minutes apart on 6 November 2026, at 11:24 UTC and 11:29 UTC.
  • What's next: Unocoin is rebuilding its server infrastructure, an exercise it estimates at four to five working days, with no restoration date announced.

Unocoin's Timeline, Hour by Hour at the Start

The exchange's security update sets out the order of events in its own words.

  • 6 November, 11:24 UTC: Unocoin requests an immediate freeze of its Fireblocks enterprise account.
  • 6 November, 11:29 UTC: it requests the same at BitGo. Both accounts held crypto balances used to run day-to-day transactions.
  • 6 November: both providers confirm the accounts are frozen and that no further transactions could be started through their platforms. "They froze Unocoin's enterprise as per our instructions on 6th November 2026, and it is so far found that the freeze has functioned as intended," the update says.
  • 9 November: further unauthorised activity is detected, and Unocoin suspends all services immediately as a precaution.

At the time of those first freezes, Unocoin says, no loss of crypto funds had been identified.

On 12 November the exchange identified outgoing transactions from one of the ETH addresses in its BitGo wallet infrastructure, an address it used to fund ERC-20 tokens.

Inside the BitGo Recovery Feature

A multisignature wallet needs more than one key to move funds, which is the point of using it: no single compromised machine should be enough. BitGo's version also includes a recovery path so that a customer can still reach the assets if BitGo itself becomes unavailable.

That is the part Unocoin suspects was misused. "BitGo multi signature wallets get created in such a way that we can still access crypto funds if BitGo ever disappear," the exchange wrote. "Such a backup mechanism seems to be exploited and we investigate this further to understand the mechanism, loss of cryptocurrency and information privacy."

Unocoin also says the transactions under review were signed and broadcast externally on-chain, outside BitGo's platform and without its involvement. BitGo has not issued a public statement on the incident, so the claim that its recovery feature was the route in remains Unocoin's alone.

The freeze cut both ways for the investigation. Unocoin says the BitGo enterprise accounts are still frozen, it cannot log in to them, and because much of BitGo's wallet architecture uses change addresses when processing transactions, it cannot fully verify the wallet positions on the blockchain either.

What it can say is that more than 90% of the crypto it holds for customers sits in cold storage.

What 81,000 Empty Addresses Do and Don't Show

Arkham Intelligence lists roughly 81,000 addresses linked to Unocoin with a collective value of $0 as of 12 November 2026. On its own, that looks like a smoking gun. Arkham's own history argues for a slower read: over the past month the same group of addresses held only a few hundred dollars at most, with a quarterly peak slightly above $250,000.

No independent investigator has tied those zero balances to the server breach. Funds moved to new wallets, unlabelled addresses, or defensive transfers ahead of a suspected compromise would all look the same from outside.

The Root Cause Is Still Open

Unocoin says its investigation established that its infrastructure had been compromised, and that the full extent, including which systems were accessed and what information may have been exposed, is still being worked out. That leaves the questions customers care about most unanswered: whether identity documents or contact details were taken, and what the transfers were worth. No loss amount has been confirmed.

There is also no timetable. The rebuild estimate of four to five working days is Unocoin's own, and it has not published a date for switching services back on. It says it will publish its findings when the investigation ends, and that its blog and X account are the only confirmed channels for updates.

Until then, the number to watch is the one Unocoin has so far declined to put on the record: what, if anything, left the wallets.