# Unocoin says wallet transfers were signed outside BitGo Author: Abdullah Özkurt Language: English Published: 2026-11-13T19:38:57+03:00 Updated: 2026-11-13T19:38:57+03:00 ![A black server module pulled partway out of a blue rack, with a silver spare on a service cart.](https://kriptometa.com/uploads/unocoin-cuzdandaki-transferler-bitgo-disinda-imzalandi-f78aa21ee5a2_article.webp) ## Key takeaways - Fireblocks and BitGo froze Unocoin’s enterprise accounts five minutes apart on November 6. - Unocoin disabled logins after detecting fresh unauthorized access on November 9. - The exchange estimated four to five working days to rebuild its servers. Unocoin said on November 13 that BitGo’s freeze on its account appeared to have held. The exchange is investigating transfers out of an Ethereum address while customer accounts remain offline. Indian [crypto exchange](https://kriptometa.com/en/best-crypto-exchanges) Unocoin has added information from BitGo to its [incident report](https://blog.unocoin.com/security-incident-update/). The exchange said the transfers it was investigating were signed outside BitGo’s platform and broadcast directly to the network. Unocoin is still checking for losses and investigating whether anyone accessed customer information. ## When did the providers freeze the accounts? When Unocoin spotted suspicious activity on Friday, November 6, it asked Fireblocks and BitGo to freeze the enterprise accounts it used for day-to-day transactions. Fireblocks initiated the freeze at 11:24 UTC and BitGo followed five minutes later at 11:29 UTC. According to Unocoin, both providers confirmed that their platforms would block new transactions on those accounts. The exchange had identified no loss of cryptocurrency at the time. Three days later, it detected further unauthorized access to its servers, disabled customer logins and suspended all services. Its [November 9 statement](https://x.com/Unocoin/status/2119735244446470277) said no funds had been lost. It later found outgoing transfers and has yet to disclose their value or the amount of any loss. ## What did Unocoin find in its wallet? On November 12, Unocoin noticed outgoing transfers from an Ethereum [wallet address](https://kriptometa.com/en/glossary/wallet-address) it used to fund ERC-20 token activity. The address belonged to one of its BitGo wallets. Unocoin asked BitGo for transaction records because it could no longer sign in to the frozen account. The exchange also said the wallet used change addresses, making it difficult to match up all the transfers from public blockchain records alone. After hearing back from BitGo, Unocoin said the freeze on its enterprise account appeared to have worked as intended. It said it was examining whether someone had used a backup designed to keep the funds accessible if BitGo became unavailable. [BitGo CEO Mike Belshe](https://x.com/mikebelshe/status/2121270526853439890) said BitGo itself had not been hacked and that Unocoin had signed transactions on its [self-custody wallet](https://kriptometa.com/en/glossary/custodial-non-custodial-wallet). Neither statement identified the individual who signed them. [Unocoin’s November 13 update on the information it received from BitGo](https://x.com/Unocoin/status/2121114829264199751) ## When will customers regain access? Unocoin said it would rebuild its server infrastructure from scratch. On November 12 it estimated the rebuild would take four to five working days. Security checks would follow before services resumed. Its [customer website](https://www.unocoin.com/in) displayed a maintenance notice. The exchange has given no date for trading or withdrawals to reopen. Unocoin says it keeps more than 90% of the cryptocurrency it holds for customers in cold storage and stores no cryptocurrency directly on its servers. Its statement did not include an independent report verifying that percentage. The exchange is still checking balances with BitGo and Fireblocks and has not said which customers were affected or what personal information may have been exposed.