Indian cryptocurrency exchange Unocoin has suspended all of its services after a server breach, leaving customers locked out of their accounts while investigators examine unexplained transactions involving the platform's BitGo custody infrastructure. The outage has taken one of India's longest-running cryptocurrency exchanges offline and underscores how, on centralized platforms, access to funds rests on infrastructure and custodial arrangements that customers cannot directly control.

The Bengaluru-based company detected unauthorized activity on its servers on November 6. A second intrusion followed on November 9, prompting the exchange to shut down its systems. Unocoin initially stated that no customer cryptocurrency had been lost, but a security update published on November 12 acknowledged that the full extent of potentially unauthorized wallet transactions remains unknown.

According to Unocoin, more than 90% of customer cryptocurrency is held in cold storage, a standard industry safeguard designed to keep the bulk of funds offline and beyond the reach of server-level attackers. Rather than attempting to restore the compromised systems, the exchange is rebuilding its server infrastructure, a process it expects to take four to five working days.

BitGo Transactions Complicate the Investigation

Unocoin requested emergency freezes on its enterprise accounts with custodians Fireblocks and BitGo shortly after detecting the initial breach. Fireblocks received the request at 11:24 UTC on November 6, and BitGo five minutes later. Both custody providers confirmed the restrictions, which were intended to prevent further transactions through the affected accounts.

Despite the freezes, Unocoin discovered outgoing transactions on November 12 involving an Ethereum address within its BitGo infrastructure that had been used to fund ERC-20 token transfers, as the company described in a blog post. BitGo is investigating the transactions, and their authorization, timing, and total value have yet to be established. The situation reflects a recurring difficulty in exchange security incidents: when assets sit with an outside custodian, the affected platform often depends on that provider's data and cooperation to reconstruct what happened.

The exchange cannot currently access its frozen BitGo accounts to review the activity. Its ability to independently reconstruct the transaction history is further limited by BitGo's use of change addresses, which can complicate the tracing of assets across multiple wallets. As a result, Unocoin has not determined whether additional unauthorized transfers occurred or whether any customer holdings were affected. The breach's entry point and the potential exposure of customer information also remain unresolved.

Scrutiny Over 81,000 Empty Wallet Addresses

The suspension has drawn further scrutiny after blockchain investigator Onchain Lens flagged in a post on X approximately 81,000 addresses attributed to Unocoin on Arkham Intelligence that collectively displayed a zero-dollar portfolio balance.

The observation raised questions about the exchange's reserves, although it does not establish that 81,000 customer wallets were drained. Arkham's tracking covers addresses identified as belonging to an entity and may not capture its complete custody infrastructure, particularly assets maintained through third-party custodians or unidentified cold-storage wallets. On-chain analysts routinely examine labeled addresses on intelligence platforms during exchange incidents as a first gauge of asset movement. Unocoin has not published a comprehensive reconciliation of customer liabilities against its current cryptocurrency holdings.

The exchange has dealt with a similar incident before. In August 2017, Unocoin temporarily suspended withdrawals after attackers exploited improperly secured access tokens captured in its error logs to carry out unauthorized wallet transactions. The company subsequently corrected the vulnerability and resumed operations.

The latest disruption follows CoinDCX's acknowledgment of nearly $16 million in losses involving previously compromised deposit addresses, another incident that raised questions about cryptocurrency exchange custody controls in India. For users of the country's centralized platforms, the episodes have made custodial arrangements — where funds are held, how they are protected, and how quickly they can be frozen — a recurring point of scrutiny.

Unocoin has not announced a firm reopening date. Customer logins, trading, and withdrawals will remain unavailable while the company rebuilds its infrastructure, verifies balances with BitGo and Fireblocks, and completes security checks before restoring operations. Developments to watch include the outcome of BitGo's investigation into the November 12 transfers and any reconciliation Unocoin publishes between customer liabilities and its current holdings, along with whether the exchange holds to its four-to-five-working-day rebuild estimate.

Source: Crypto Adventure