On 9 November 2026 Unocoin, an Indian crypto exchange, suspended every service. Its own blog says it had found further unauthorised activity that day, switched off logins, and then established that its infrastructure had been compromised. It has not published a loss total. It has not said which customer records were copied. Three days earlier, on 6 November, it had asked its custodians to freeze the enterprise accounts that hold the coins used for ordinary transfers: Fireblocks at 11:24 UTC, and BitGo at 11:29 UTC. Both confirmed the freeze. At that moment, Unocoin says, no loss of crypto had been identified. A freeze on the 6th and a shutdown on the 9th are the same investigation. They are not two thefts.
Unocoin is an exchange. The number on the screen is a claim on the company, and the screen is off. What is a crypto exchange balance?. The coins sit with custodians, BitGo and Fireblocks, not on a server in the exchange’s office. Unocoin says more than 90 percent of customer crypto is in cold storage, and that the count of what is actually there is not finished. A percentage in a blog post is the company’s sentence. It is not a receipt.
What happened
On 12 November the blog added two findings. Unocoin said it would rebuild the servers from scratch, about four to five working days, rather than switch the old ones back on. The same day it said it had found outgoing transactions from an Ethereum address inside its BitGo wallets, the address it used to fund tokens on Ethereum. It could not log in to the frozen BitGo account to read the full history, and it asked BitGo for the transactions. On 13 November it said BitGo’s freeze had worked as asked, and that the transactions in question were signed and broadcast on the chain without going through BitGo’s platform. BitGo’s wallets, Unocoin says, are built so the customer can still reach the coins if BitGo itself disappears. That backup path is what Unocoin says it is now investigating. This page will not describe how a backup signs a transaction.
The Block quotes BitGo as saying its own systems were not breached, and that the transaction was signed with keys the customer holds. That is BitGo’s sentence, as The Block reported it. It is not a loss figure, and it is not Unocoin saying the coins are all still there. An account that is frozen at the custodian can still be spent by someone who already holds the other keys. The freeze stops the custodian’s own button. It does not unwind a transaction that was already signed somewhere else.
Why it matters
If your coins are on Unocoin, you cannot log in, and you cannot withdraw, until the exchange says the rebuilt service is back. You are waiting on a company that has not yet said whether anything is missing. If your coins are in a wallet whose keys you hold, this shutdown did not spend them. See How crypto wallets actually work.
A custodian is not a chain. BitGo freezing an enterprise account is that company’s switch. Fireblocks confirming a freeze is a second company’s switch. Neither one is a government deposit scheme, and neither one is a statement that a backup key was never copied. The same shape, with a published dollar figure, is Binance’s hot-wallet loss. Unocoin has not published the figure. A message that offers to “restore” a login, and asks for a recovery phrase, is not the blog. See How do you keep crypto safe?.
What happens next
A loss total, if Unocoin publishes one. The rebuilt servers, which the 12 November note put at about four to five working days and which are not a date for withdrawals. Whatever BitGo’s investigation adds to the backup-path sentence. Watch Unocoin’s own blog. We will not treat a custodian freeze as proof that nothing left, and we will not treat “more than 90 percent in cold storage” as a finished count.
Not a recommendation to deposit, withdraw, or close an Unocoin account. Not a finding that BitGo or Fireblocks was breached. Not a description of the access. The company’s own account is a shutdown, an unfinished count, and outgoing transactions it has not yet explained.
