Unocoin keeps logins suspended after detecting outgoing BitGo ETH transactions

Unocoin, a cryptocurrency exchange in India, has detected outgoing transactions from an ETH address within Unocoin's BitGo wallet infrastructure. Customers have been unable to access accounts since November 9, and the login suspension continues. Unocoin said the exchange discovered the transactions on Thursday and immediately notified BitGo. Unocoin said BitGo has begun investigating the activity.

Unocoin said the security incident began on November 6, when the exchange detected unauthorized infrastructure activity and took precautions to safeguard customer funds. Unocoin said the exchange requested that BitGo and Fireblocks immediately freeze Unocoin's enterprise accounts. Those accounts hold cryptocurrency balances used for routine transactions. Unocoin said further unauthorized activity on Monday prompted the exchange to halt every service immediately to protect customer assets and data. The measures included suspending logins.

Unocoin says cold storage holds more than 90% of customer cryptocurrency. Unocoin also says the incident caused no loss of funds. However, Unocoin declined to assure a user on X that funds could be recovered before transaction-level details are verified. Unocoin said the exchange cannot access the frozen accounts. Unocoin said BitGo's change addresses restrict the exchange's ability to examine on-chain activity. Unocoin acknowledged in an incident report that the exchange cannot fully identify all potentially unintended transactions involving Unocoin's BitGo wallets.

Unocoin estimates that rebuilding the exchange's servers entirely will require four to five working days. Investigators continue to examine the breach, possible data exposure and the status of customer holdings.

Onchain Lens reported that Arkham displayed balances totaling $0 across 81,000 Unocoin addresses tracked by Arkham. Onchain Lens also reported that Unocoin's website displayed a 504 error. Unocoin has not confirmed that funds were drained from the tracked wallets.