Unocoin Flags Suspicious Transfers, Suspends All Services

By Elena Vasquez

Unocoin suspended all services on Nov. 9 after detecting further unauthorized activity, the Indian cryptocurrency exchange said. The company has not disclosed the transfers’ value or confirmed losses. Unocoin says a freeze on its enterprise account prevents it from viewing all suspicious transactions.

Unocoin flagged suspicious transfers from an Ether (ETH) address in a BitGo wallet used to fund ERC-20 tokens. BitGo is investigating the activity. Unocoin’s investigation found “its infrastructure had been compromised.”

What did Unocoin detect, and when?

Unocoin first detected unauthorized activity on Nov. 6 and requested freezes on its enterprise accounts at Fireblocks and BitGo that day. The exchange found further unauthorized activity on Nov. 9 and suspended all services.

The three-day interval establishes when Unocoin detected more activity, not when the compromise began. The company has not said when affected systems were first exposed. In plain terms, the response moved from account freezes to a service shutdown.

Which wallet and tokens are involved?

The disclosure identifies the asset as Ether (ETH) and the wallet provider as BitGo. It does not specify which ERC-20 tokens were involved, the destination addresses or the amount transferred.

BitGo is investigating the activity, but the announcement does not state whether the wallet belongs to Unocoin, a user or another party. For customers, the practical question is whether any user balances are affected, and Unocoin has not confirmed losses. The token mechanics are identified, but ownership and losses remain unconfirmed.

Why do freezes limit the investigation?

Unocoin requested freezes on its enterprise accounts at Fireblocks and BitGo on Nov. 6. The exchange says a freeze on its enterprise account prevents it from viewing all suspicious transactions.

That limitation can constrain an exchange’s ability to trace activity or distinguish unauthorized transfers from legitimate ones. The disclosure does not say whether the visibility limit applies at Fireblocks, BitGo or both, nor how much information remains visible. In plain terms, a partial transaction view weakens the audit trail.

What does the cold-wallet claim establish?

Unocoin says cold wallets hold more than 90% of its users’ cryptocurrency, and those wallets are kept offline. For every 10 units of user cryptocurrency, the stated ratio places more than nine units in cold storage.

The statement describes where assets were held, not a finding that the offline wallets themselves were breached. Unocoin has not said how the compromise occurred, and the cold-wallet ratio does not resolve that question. In plain terms, more than 90% of user crypto was offline, but the cause remains unknown.

How long will the rebuild take?

Unocoin said it was rebuilding its server infrastructure “from scratch” and expected the work to take “about four to five business days.” The estimate covers the rebuild, not a stated deadline for restoring services or completing the investigation.

The disclosure does not specify a service-restoration date, a final loss figure or a conclusion on data exposure. A completed rebuild would not, by itself, determine who caused the intrusion or what data was exposed. Put simply, the four-to-five-day estimate covers the rebuild, not the whole recovery.

What remains unresolved?

Unocoin said the cause, full impact and any data exposure remain under investigation. BitGo is also investigating the flagged transfers, but the disclosure gives no timetable for either inquiry.

Unocoin expects the server rebuild to take about four to five business days, but it has not set a date for restoring services or closing the investigation. Until those findings are published, customers have neither a confirmed loss figure nor a documented explanation of the breach.