Unocoin Suspends Logins as 81,000 Linked Wallets Show Zero Balances

Indian cryptocurrency exchange Unocoin has temporarily suspended user logins following unauthorized access to its servers, according to a disclosure first reported on Nov. 9 and surfaced on Nov. 12 by the on-chain analysis account Onchain Lens on X. Blockchain analytics platform Arkham shows assets held across roughly 81,000 wallet addresses linked to Unocoin displaying zero balances, while the exchange's website is returning a 504 server error.

The scope of the incident remains unverified. It has not yet been confirmed whether the unauthorized access resulted in actual asset outflows, nor has any estimate of the damage been established. Onchain Lens said it is reviewing on-chain fund flows to determine exactly what happened.

What does this change for Unocoin's users?

For an exchange that has operated in India since the early years of the domestic crypto market, the operational signal is stark. Three facts sit alongside each other: a disclosed breach of servers, a login suspension, and wallets — tens of thousands of them, roughly 81,000 by Arkham's tally — showing no assets. Taken together, they describe a platform that has lost control of both its infrastructure and, at minimum, its visibility into user holdings.

A 504 gateway timeout means the exchange's servers are failing to respond at all. Users cannot log in, and the exchange has given no timeline for restoration. The practical question every account holder faces right now is whether the zero balances reflect an actual drain of funds or a display failure on a compromised system. Neither Unocoin nor the on-chain analysts following the flows have answered that yet.

Why on-chain review matters before conclusions

The verification burden now sits with blockchain analytics. Because exchange wallets operate on public chains, movements from addresses tied to Unocoin can, in principle, be traced. Onchain Lens's stated review of fund flows is the mechanism by which this incident moves from suspicion to quantified loss — or to a narrower explanation centered on server compromise without theft.

That distinction carries real consequences. A confirmed drain of exchange-controlled wallets would put Unocoin in the category of exchange failures where user recovery depends on the company's solvency and any applicable Indian regulatory or legal channels. A display-side failure with intact reserves would instead point to a recovery of service, though still with hard questions about how unauthorized server access occurred in the first place.

The 81,000-address figure deserves framing. It represents the set of wallets Arkham associates with the exchange, not a confirmed count of affected users or a measure of stolen value. Until flow analysis or an Unocoin statement establishes otherwise, it is an indicator of platform scale — and of how many account relationships this incident now touches.

What comes next

No confirmed loss figure, no attributed party and no restoration date exist as of Nov. 12. The immediate watch items are concrete: on-chain analysis of outflows from Unocoin-linked addresses, a formal statement from the exchange on reserves and user access, and any response from Indian authorities once the facts are established.