Unocoin says a backup mechanism in its BitGo wallets appears to have been exploited; services stay suspended

Indian crypto exchange Unocoin said on Friday, November 13, 2026, that transfers out of one of its wallets were signed and sent outside the platform of its custody provider BitGo, and that a backup mechanism in those wallets "seems to be exploited." The exchange has kept all services suspended since November 9 and has not said whether it lost any crypto, according to its incident update.

What Unocoin says happened

Unocoin's account comes from a statement it published on November 12 and updated on November 13. The exchange uses two outside providers, BitGo and Fireblocks, to hold the crypto it needs for day-to-day transactions.

According to the statement, the exchange detected unauthorized activity on Friday, November 6, and asked both providers to freeze its accounts. The Fireblocks freeze started at 11:24 UTC and the BitGo freeze at 11:29 UTC, and both providers confirmed that no further transactions could be made through their platforms. At that point, the exchange said, no loss of crypto had been identified.

On Monday, November 9, Unocoin said, it detected more unauthorized activity and suspended all services. It said its investigation then established that "our infrastructure had been compromised," and that it does not yet know which systems were accessed or what information may have been exposed.

On November 12, the exchange said, it found outgoing transactions from one of the Ethereum addresses in its BitGo wallet setup, which it used to fund transfers of ERC-20 tokens, the standard for tokens issued on Ethereum.

The BitGo wallet finding

In the November 13 update, Unocoin said BitGo had frozen its account as instructed and that the freeze "has functioned as intended." The transactions in question were signed and broadcast directly on the blockchain, without BitGo's platform, the exchange said.

Unocoin's explanation is that BitGo's multi-signature wallets, which need more than one key to approve a transfer, are built so that a customer can still reach its funds if BitGo itself disappears. "Such a backup mechanism seems to be exploited," the exchange wrote. It said it is still investigating how this was done and whether any crypto was lost.

This is Unocoin's account. BitGo has not commented publicly in the sources we read, and neither company responded to a request for more information from Cointelegraph before it published its report.

Unocoin also said it cannot see the full picture yet. Its BitGo accounts are frozen, it cannot log in to them, and the way the wallets use change addresses makes it hard to check every transaction on the blockchain, according to the statement.

What is not known

The exchange has not said how much, if anything, was taken, who is responsible, or how its systems were breached. It said the root cause "and the complete sequence of events" have not been established.

It has not given a date for reopening. On November 12 it said it would rebuild its whole server infrastructure and estimated that this would take about four to five working days.

Why it matters

Unocoin's statement describes an exchange whose own systems were compromised while the crypto it uses for day-to-day transactions sat with outside custody providers. If its account is right, freezing the provider accounts did not stop transfers that were signed elsewhere.

Other exchanges have also halted customer activity after security incidents in recent weeks: on November 2, Mercado Bitcoin halted deposits and withdrawals after a suspected hack. In India, the Enforcement Directorate searched premises linked to two other exchanges on November 4 and 5 in an unrelated case.

What it could mean for traders

Customers cannot deposit, withdraw or trade on Unocoin while services are suspended. The exchange's statement that most customer crypto is in cold storage, meaning in wallets kept offline, is its own claim and has not been independently checked.

For anyone with funds on the platform, the points to watch are the exchange's next update, the amount of any loss, and what it says about covering any customer losses. Its incident update says nothing about that. For background, our analysis of exchange risk after the Binance hack covers who absorbs a loss and how long access to funds can disappear.