India-based cryptocurrency exchange Unocoin has disclosed unauthorized access to its server infrastructure, prompting the platform to temporarily disable user logins as a security precaution. The disclosure was made on November 9 and has raised concerns about the operational security of the long-standing exchange and the current status of customer assets.

OnchainLens reported the security incident, while blockchain intelligence platform Arkham Intelligence displayed zero holdings across approximately 81,000 addresses associated with Unocoin. At the same time, the exchange's website reportedly returned HTTP 504 gateway timeout errors, indicating that users were experiencing difficulties accessing the platform.

Together, the server breach, the login suspension, and the apparent zero balances in tracked wallets have left the status of customer funds unresolved while investigators examine the unauthorized access and any potential on-chain movements.

India's Oldest Crypto Exchange Suspends Logins

Founded in 2013, Unocoin is regarded as India's oldest cryptocurrency exchange and has played a role in the development of the country's digital asset trading industry. Over that period, the platform operated through major shifts in India's regulatory environment for digital assets, including the Reserve Bank of India's 2018 circular that directed banks to cease serving crypto businesses and the Supreme Court of India's 2020 ruling that set the circular aside.

The company disclosed the unauthorized access to its server infrastructure on November 9. Following the discovery, the exchange temporarily disabled customer logins, restricting access to user accounts while the security incident was being examined.

Disabling logins can help limit unauthorized account activity during an ongoing investigation, but the move also prevents legitimate customers from accessing their accounts and checking their holdings through the platform. The situation carries additional weight on a centralized platform because customers hold claim-based balances rather than direct control of wallet keys, making the exchange's own disclosures the primary channel through which account holders can learn the status of their funds.

The information available so far does not establish whether the unauthorized access resulted in the compromise of customer accounts, administrative systems, or wallet infrastructure. The precise method used to gain server access also remains unclear.

The incident highlights the broader security challenges facing cryptocurrency exchanges, which must protect both their internet-facing infrastructure and the systems responsible for managing customer assets.

Arkham Intelligence Shows Zero Tracked Holdings

Blockchain intelligence data has added another dimension to the incident. Arkham Intelligence reportedly displayed zero-dollar balances across approximately 81,000 addresses associated with Unocoin.

The reported figures have drawn attention because cryptocurrency exchanges typically maintain digital asset reserves across multiple wallet addresses to facilitate customer withdrawals, deposits, and internal treasury operations.

However, a zero balance across tracked addresses does not independently establish that customer funds have been stolen or transferred by unauthorized parties. Exchange wallet activity can involve address changes, internal transfers, custody arrangements, and other movements that may not be fully reflected in a limited set of tracked addresses. Tracking platforms such as Arkham display balances only for addresses they have attributed to an entity, so assets held at unlabeled addresses or through custody arrangements outside the labeled set would not appear in the published totals, which is one reason investigators pair platform dashboards with direct on-chain tracing before drawing conclusions about reserves.

OnchainLens highlighted the situation in a post on X on November 12:

INDIA'S OLDEST CEX HACKED? 81K WALLETS SHOW $0

Unocoin reported unauthorized server access on November 9 and temporarily disabled user logins.

Meanwhile, Arkham shows $0 in holdings across its 81,000 tracked addresses, while its website is returning a 504 error.

We are investigating onchain movements to determine the exact modus operandi.

— Onchain Lens (@OnchainLens) November 12, 2026

Investigators are reportedly examining on-chain transactions to determine whether assets were moved and whether any transfers were connected to the unauthorized server access. Establishing the actual status of customer funds will require additional verification, including identifying the relevant wallet addresses, tracing transaction destinations, and determining whether any assets remain under the exchange's control.

Website Errors Compound Customer Difficulties

Unocoin's website was also reportedly returning HTTP 504 gateway timeout errors during the incident. This type of error generally occurs when a gateway or proxy server does not receive a timely response from an upstream server.

The website disruption, combined with the suspended logins, has limited customers' ability to access the exchange and obtain information about their accounts. For cryptocurrency platforms, prolonged service interruptions can create uncertainty because customers depend on exchange infrastructure to monitor balances, execute trades, and initiate withdrawals.

Scope of the Incident Not Yet Confirmed

The available reports have not confirmed the exact entry point used by the attackers, the extent of the server compromise, or whether customer assets have been affected. No verified loss figure has been established from the information currently available.

The key issue remains whether the unauthorized access was limited to server infrastructure or extended to systems controlling cryptocurrency wallets and customer funds. Developments that could clarify the picture include whether Unocoin restores user logins and publishes findings from its security review, whether the ongoing on-chain investigation confirms any asset movements, and whether Arkham's displayed totals change as address attributions are updated.

The incident also underscores the importance of transparent security disclosures, independent wallet verification, and reliable communication during exchange outages. Until investigators establish the breach mechanism and verify the status of the exchange's reserves, the full financial and operational impact on Unocoin and its customers remains uncertain.

Source: CoinTrust