Mentioned in This Article
1. Unocoin hack update: transactions from a BitGo-held Ethereum address
Indian crypto exchange Unocoin disclosed on Thursday, November 12, that one of its Ethereum (ETH) addresses held within BitGo's wallet infrastructure sent out transactions the company cannot yet fully trace. The update to the Unocoin hack investigation came three days after the exchange suspended all services, and it gives no amount, cause or destination for the funds.
The affected address, Unocoin said, was one it used to fund ERC-20 tokens, the family of Ethereum-based assets built to a shared technical standard. The exchange posted the finding as an addition to its running incident notice rather than as a separate announcement, and the language it used was cautious: it described the outflows as transactions it had identified, not as a confirmed theft with a known size.
For customers who have been locked out of the platform since Monday, the update raises as many questions as it answers. It confirms that something moved out of an address under BitGo's custody, but it stops short of saying how much, how many transactions were involved, where the assets went or whether any customer balances were touched.
2. What did Unocoin disclose about the BitGo transactions?
Unocoin said it found outgoing transactions from a single Ethereum address in its BitGo setup and has escalated the matter to BitGo, which has opened an investigation into how those transactions were carried out. According to Unocoin, BitGo has confirmed that it is handling the issue as a priority.
BitGo is a custody provider: a company that holds and secures digital assets on behalf of clients such as exchanges, funds and other businesses. Institutional custodians of this kind typically control access through layered approval systems, so that moving funds requires several sign-offs rather than a single key. That structure is one reason a disclosure of untraced outflows from a custodied address attracts attention, because it implies that either the approval process was satisfied by someone who should not have been able to satisfy it, or that something else in the chain failed.
No public statement from BitGo on the matter could be found at the time of Unocoin's update. Until the custodian speaks, the only account of what happened is the one Unocoin itself has provided, and that account is explicitly incomplete.
Several basic details remain absent from the exchange's notice. Unocoin did not state the value of the assets that left the address, the number of transactions, the receiving address or addresses, or what it believes caused the activity. Those are the figures that typically determine how serious an exchange incident turns out to be, and their absence makes it impossible for now to gauge the scale of the event.
3. Why Unocoin says it cannot see the full picture
A frozen account and an unusual wallet design are the two obstacles Unocoin cited for its limited view. The exchange said its enterprise accounts at BitGo remain frozen and that it is unable to log in to them, which cuts it off from the dashboards and records it would normally use to review activity.
Unocoin also pointed to BitGo's use of change addresses, which it said make up a significant part of the custodian's wallet architecture. A change address is a freshly generated address that receives the leftover balance after a transaction is sent. Rather than returning the remainder to the original address, the system parks it somewhere new. The approach can improve privacy and is a common pattern in wallet engineering, but it also scatters a client's holdings across many addresses that are not obviously linked to one another on a public blockchain.
That fragmentation is what Unocoin said limits its ability to follow the activity on-chain. Public blockchains such as Ethereum record every transfer openly, so in principle anyone can trace funds from one address to the next. In practice, tracing requires knowing which addresses belong to whom. If an exchange cannot log in to its custody account to see the full list of addresses generated on its behalf, it may be unable to tell which outbound transfers came from its own wallets.
The exchange acknowledged as much. It said it does not currently have full visibility into all potentially unintended transactions across its BitGo wallets, and that it has asked BitGo for transaction-level details. In effect, Unocoin is relying on the custodian to tell it what left its own accounts.
4. Are Unocoin customer funds safe?
Unocoin has not said whether any user balances were affected by the BitGo outflows. What it has said is that more than 90% of the crypto it holds for customers sits in cold storage, meaning offline wallets that are not connected to the internet.
Cold storage is the standard defense exchanges use against remote attacks. Because the private keys for cold wallets are kept offline, an intruder who compromises an exchange's servers or online systems generally cannot move those funds without physical access or additional authorization steps. The remaining portion of an exchange's holdings is usually kept in online, or hot, wallets so that customer withdrawals and trades can be processed quickly. That hot portion is the part most exposed when infrastructure is breached.
The cold storage figure offers some reassurance about the bulk of customer assets, but it does not settle the question raised by the latest disclosure. The update does not specify how the BitGo-held Ethereum address fits into that split, nor whether the outflows drew on assets belonging to customers or to the company itself.
5. A timeline of the Unocoin incident
The trouble began on Friday, November 6, when Unocoin detected unauthorized activity on its systems. The exchange responded by asking its two custody providers to freeze its enterprise accounts. It contacted Fireblocks at 11:24 UTC and BitGo five minutes later, at 11:29 UTC. Both providers confirmed the freezes, and at that point Unocoin had not identified any losses.
Freezing custody accounts is a common first step when an exchange suspects a compromise. It is meant to prevent any further transfers while the company works out what has happened, essentially pulling the plug on outbound movement until the source of the problem is understood. The speed of Unocoin's requests, made within minutes of each other, suggests the exchange moved quickly once it spotted the activity.
The freezes did not end the episode. On Monday, November 9, Unocoin observed further unauthorized activity and suspended all of its services. Its internal investigation concluded that its infrastructure had been compromised. The exchange said it is rebuilding its servers from scratch, a process it expects to take four to five working days, and that it has not yet determined the root cause of the breach.
Rebuilding servers from the ground up, rather than patching them, is a measure companies take when they cannot be confident that an attacker has been fully removed from their systems. It is slower and more disruptive, but it reduces the risk that a hidden foothold survives into the restored platform. Thursday's disclosure about the BitGo address arrived while that rebuilding work was under way.
6. How Unocoin's public messages compare
Unocoin's social media statements and its formal incident notice do not line up neatly. On November 9, the exchange told users on X that no crypto funds had been lost. On Thursday, in a reply on the same platform posted roughly two and a half hours before the blog update was last revised, it again said that no user funds had been lost.
The blog update, by contrast, describes an exchange that cannot access its BitGo accounts, does not have full sight of the transactions that may have left them, and offers no figure for what departed. Those statements are not strictly contradictory, since a claim that no user funds were lost could still hold if the outflows involved only company assets, or if the amounts are eventually recovered or covered. But the update leaves the earlier assurance resting on information the exchange itself says it does not yet have.
For users, the gap matters because the two messages point in different directions. One offers a firm reassurance; the other describes an investigation still waiting on basic data from a third party. Until BitGo delivers the transaction-level records Unocoin has requested, neither the company nor its customers can fully reconcile the two.
7. A recurring problem for Indian crypto exchanges
Unocoin is not the first Indian platform to face the aftermath of a security breach. Rival exchange CoinDCX absorbed losses in October after a failed attempt to sweep funds from addresses that had been compromised in its 2025 hack. A sweep is an operation to move remaining assets out of exposed addresses into safer ones, and when it goes wrong, the funds can end up in the wrong hands instead.
The two cases share a common thread: the difficulty of fully regaining control of wallet infrastructure once it has been compromised. Even after an initial incident is contained, leftover access, overlooked addresses or flawed recovery steps can lead to further losses. Unocoin's latest disclosure, which emerged days after the original freeze and after a second round of unauthorized activity, fits that pattern of an incident that continues to unfold after the first response.
Exchanges that rely on outside custodians also face a coordination challenge. When an exchange's own systems are breached but its assets sit with providers such as BitGo and Fireblocks, the investigation depends on information held by several parties. Unocoin's statement that it is waiting on BitGo for details illustrates how that division of responsibility can slow down a full accounting.
8. What happens next for Unocoin users
The next step in the Unocoin investigation rests largely with BitGo. Unocoin has requested transaction-level details from the custodian, and those records should reveal how many transactions left the affected address, their value and where they went. BitGo's own investigation into how the transactions were executed may also shed light on whether the cause lay in Unocoin's compromised infrastructure or elsewhere.
Separately, Unocoin's server rebuild, which it estimated at four to five working days, will determine when the exchange can consider restoring services. The company has not yet identified the root cause of the breach, and finding it will likely be a precondition for reopening the platform with confidence.
Customers will also be watching for a clear answer on whether any user balances were affected. The exchange's repeated statements that no user funds were lost will be tested against whatever figures BitGo provides. Until then, Unocoin's services remain suspended, its BitGo accounts remain frozen, and the size of the outflows from its Ethereum address remains unknown.