Unocoin finds coins left a frozen BitGo wallet after server breach

Indian crypto exchange Unocoin says its infrastructure was compromised and that it has found outgoing transactions from one of its BitGo wallets, even though it had asked BitGo to freeze its accounts six days earlier. In a security incident update published at 07:32 UTC on Thursday and shared on X, the company says it spotted the transactions on November 12 from an ETH address it used to fund ERC-20 tokens. It has not said how much was sent or where it went.

Unocoin says it cannot establish the full extent of the transactions yet. Its BitGo enterprise accounts are still frozen, it cannot log in to them, and because BitGo's wallets send change to new addresses it cannot trace everything on the blockchain either. It has asked BitGo for transaction-level details, and says BitGo is investigating how the transactions could have been executed.

The timeline Unocoin gives

Unocoin says it first detected unauthorised activity on Friday, November 6. It asked its two custody providers to freeze its enterprise accounts within minutes of each other, Fireblocks at 11:24 UTC and BitGo at 11:29 UTC, and says both confirmed that no further transactions could be started. It says it keeps no cryptocurrency on its own servers, and that no loss of funds had been found at that point.

After rechecking and strengthening what it calls apparent and assumed vulnerabilities, it detected more unauthorised activity on Monday, November 9, and suspended all services. Its investigation then established that its infrastructure had been compromised. The root cause, the systems the attackers reached and what data may have been exposed are still unknown, the company says. It is rebuilding its entire server infrastructure rather than restoring it, which it expects to take four to five working days.

What customers were told

The exchange's replies to users gave a different picture. Replying to a user on X at 09:49 UTC on Thursday, two hours after the update went up, Unocoin said crypto withdrawals had been paused before November 9 for system maintenance, and that the unauthorised access to its servers was identified on November 9. Another reply later that morning moved the first detection to November 6.

The update says more than 90% of the crypto it holds for customers is in cold storage. In replies posted at 10:57 UTC, Unocoin told users that no customer funds have been lost, while the update itself says it does not yet have full visibility of the transactions from its BitGo wallets. Users still cannot log in, and the exchange has given no date for restoring services.

What is not known

Unocoin has not said how the attackers got in, how transactions left a wallet it had asked BitGo to freeze, how much was taken, or whether customer data was accessed. Neither BitGo nor Fireblocks has commented publicly. Unocoin says it will publish further updates as its findings are verified.