Unocoin Infrastructure Breach and Ethereum Transfers Keep Platform Services Suspended
Key Facts
India’s Unocoin said its infrastructure had been breached after an investigation began following the detection of unauthorized activity on November 6, 2026. In a security update, the company said it detected transfers on November 12 from an Ethereum address within the BitGo wallet infrastructure it uses to fund ERC-20 tokens. It referred the transfers to BitGo for investigation, while saying the inquiry had not yet established the breach’s root cause or the sequence of events. The update puts the suspected transfers and security investigation at the center of the incident, while platform services remain suspended. The company’s statement did not confirm claims that users’ balances had appeared as zero.
Unocoin said it requested a freeze of its institutional accounts at Fireblocks and BitGo on November 6, and that the providers confirmed they had carried out the request. The Fireblocks account freeze began at 11:24 UTC, followed by the BitGo account freeze at 11:29 the same day. The company said it had not detected any loss of assets when it took those initial steps. The freezes followed its detection of unauthorized activity, in what the company said was an effort to limit risks to its institutional accounts. That alone does not resolve the question of the transfers it detected later, which the company said remain under investigation.
On November 9, the platform detected additional unauthorized activity and immediately suspended all its services, according to its statement. It said the suspension was a precaution to protect customers’ assets and data. The company later said the investigation had established that its infrastructure was breached, but that the scope, the systems accessed and the information that may have been exposed remain under investigation. The company has thus acknowledged a breach while leaving details of potential access and its effects unresolved. The update did not specify the amount of assets that may have been affected or the information that may have been exposed.
Unocoin said it currently lacks a complete view of all transfers that may have been unintended through its BitGo wallets. It attributed this to the freeze on its BitGo accounts, which prevents it from logging in, and said it had asked the provider for transaction details. This constraint leaves the picture of the transfers incomplete as the company investigates the outgoing transactions it detected. The platform had said that more than 90% of cryptocurrency assets held on behalf of customers were in cold storage. The figure describes the company’s stated approach to storing assets, while verification of the transfers and related accounts is ongoing.
Unocoin plans to rebuild its server infrastructure from scratch before resuming operations. The company estimated the work would take about 4 to 5 business days, according to its November 12 update, and said it would conduct security checks before restoring services. The timeline ties the resumption of operations to completion of the rebuild and security verification, rather than simply ending the precautionary suspension. The company did not announce a specific date for restoring services beyond the estimate in the update. The available information also did not include a final outcome of BitGo’s investigation into the transfers or confirmation that the breach’s scope had been fully determined.