Unocoin Security Breach: Services Suspended in India

Unocoin, one of India's oldest cryptocurrency exchanges, has suspended all of its services after a security breach compromised its infrastructure. The exchange first detected suspicious activity on 6 November, found unauthorised access to its servers on 9 November, and in a security update published on 12 November confirmed that its infrastructure had been compromised and that it is rebuilding its server systems from scratch. User logins have been disabled since 9 November, the website was returning errors on 12 November, and the exchange has not given a date for services to return. This guide explains what Unocoin has confirmed, what remains unresolved, what the much-discussed wallet data does and does not prove, and what Indian users should do while the exchange is offline.

> Educational content only. This is not financial advice. Crypto markets are volatile — never invest money you can't afford to lose. This guide explains a published security incident; it does not recommend buying, selling or holding any asset, and it does not predict where prices will go.

What Happened: The Facts at a Glance

The facts, as reported on 12 November 2026 by Moneycontrol, crypto.news, Blockonomi, FinanceFeeds, cryptonews.net, CryptoDarshan and The Crypto Guide, are:

• Unocoin is one of India's oldest crypto exchanges, operating since 2013, with more than 2.5 million users. It launched UnocoinXPledg, a bitcoin-backed lending product, only two weeks ago, on 29 October.
• Suspicious activity was first detected on 6 November. Unocoin says it then took precautionary measures, including requesting immediate freezes on its enterprise accounts with custody providers BitGo and Fireblocks, which hold funds used for day-to-day transactions. Both providers confirmed the accounts were frozen, according to Moneycontrol.
• Unauthorised access to Unocoin's servers was identified on 9 November. The exchange temporarily disabled user logins and said its security team was investigating. At that point it said no cryptocurrency funds had been lost.
• All services remain suspended. Unocoin says it is rebuilding its server environment rather than restoring the compromised one, and estimates that work at four to five working days, followed by security validation before services return.
• On 12 November, Unocoin detected outgoing transactions from an Ethereum wallet held with BitGo, even as it rebuilds its systems, according to Moneycontrol's report of the exchange's security update. The exchange says it cannot yet establish the full transaction picture or the complete status of customer holdings.
• No loss figure has been confirmed. Unocoin has not published a verified total for any cryptocurrency loss, and it has not said how attackers gained access or which systems were affected.
• Over 90% of customer crypto is kept in cold storage, according to the exchange. That is a company statement, not independent proof of reserves.
• Blockchain data raised fresh questions on 12 November. Analytics account Onchain Lens highlighted Arkham Intelligence data showing about 81,000 addresses attributed to Unocoin with a displayed portfolio value of zero. No independent investigator has confirmed a link between that data and the breach.

The Timeline: 6 November to 12 November

The sequence matters, because the story changed as the week went on — and the exchange's early reassurance now reads differently from its latest update.

6 November — suspicious activity detected. Unocoin says it spotted suspicious activity and moved to protect its holdings, asking BitGo and Fireblocks to freeze its enterprise accounts. At this stage, the exchange said no loss of cryptocurrency funds had been identified. That statement was about the position at the time, and it should not be read as a current all-clear.

9 November — unauthorised access confirmed, logins disabled. Unocoin's statement that day said its security team had identified unauthorised access to its servers, and that user logins had been temporarily disabled while the team investigated. The exchange repeated that no customer funds had been lost and promised more information as the investigation progressed. Users have been locked out since that day.

11 November — the same message, repeated. On 11 November the exchange was still responding to worried customers on social media, repeating that funds remained safe and that logins would stay suspended until security checks were complete. It gave no date for restoring access and no technical detail about the breach.

12 November — website down, new activity detected, rebuild announced. By 12 November, Unocoin's website was returning a Cloudflare 504 Gateway Time-out error — the server behind the site was not responding — and later in the day it displayed a page describing scheduled server maintenance. That differed from the 9 November notice, which had attributed the disruption to unauthorised server access. The same day, the exchange published its security update: its infrastructure had been compromised, outgoing transactions from an Ethereum wallet held with BitGo had been detected, and the full picture of transactions and customer holdings could not yet be established. The exchange said it would recreate its server environment from scratch, estimating four to five working days plus security validation.

Four days of lockout, a website that stopped responding, and an update that widened rather than narrowed the uncertainty — that is why this story escalated from a routine incident notice into one of the day's most-read crypto stories in India.

What Unocoin Has Confirmed — and What It Has Not

It is worth being precise about the line between what the exchange has stated and what nobody has established yet, because the gap between the two is the whole story.

Confirmed by Unocoin: suspicious activity on 6 November; unauthorised access to its servers on 9 November; user logins disabled since 9 November; freezes requested on its BitGo and Fireblocks enterprise accounts, and confirmed by both providers; its infrastructure compromised; outgoing transactions from an Ethereum wallet held with BitGo detected on 12 November; a full server rebuild under way, estimated at four to five working days plus security validation; over 90% of customer crypto held in cold storage.

Not confirmed: how attackers gained access; which systems were affected; whether customer data was exposed; the amount of any cryptocurrency loss; the full status of customer holdings; a date for restoring logins, trading or withdrawals; or any independent verification of the cold-storage claim.

The distinction between a confirmed server compromise and a quantified loss is the key point. Unocoin's statement confirms the first and does not give a verified total for the second. Its earlier assurance that no loss had been identified was made on 6 November, before the 9 November discovery and before the 12 November wallet activity — so it describes the position at the start of the incident, not the position now. Readers should also note that the exchange has not published a proof-of-reserves snapshot or an incident report, and that until it does, users have no independent way to check the position of their own funds.

The Arkham $0 Question: What the Wallet Data Does and Does Not Prove

The detail that spread fastest on 12 November was the Arkham Intelligence data: about 81,000 addresses attributed to Unocoin showing a combined portfolio value of zero, highlighted by the analytics account Onchain Lens. It is easy to read that as proof that the exchange's wallets are empty. That reading would be wrong — or at least, it is not what the data proves.

Arkham's data covers only the assets its platform attributes to Unocoin. It does not cover every wallet the exchange controls, and cold-storage wallets — where Unocoin says over 90% of customer crypto sits — are typically not visible in the same way as the hot wallets used for day-to-day transactions. A zero balance on attributed addresses can mean the funds were moved, or it can mean the attribution is incomplete, or that the exchange moved funds itself as part of its emergency response, including the freezes it requested on 6 November. Blockonomi, reporting the same data, states plainly that no independent investigator has confirmed a link between the empty wallets and the breach, and FinanceFeeds makes the same qualification.

What the Arkham data does prove is narrower but still important: the public information available on 12 November does not reconcile with the exchange's assurance. Users cannot see their funds, cannot log in, cannot withdraw, and the exchange has not explained the wallet data or published its own accounting. That is a transparency gap, not a confirmed theft — and the difference matters, because a confirmed theft and an unexplained data gap call for different responses from users and from regulators.

Why Cold Storage Matters Here

Unocoin's most important reassurance is its statement that over 90% of customer cryptocurrency is kept in cold storage. For readers new to the term, cold storage means crypto held in wallets that are not connected to the internet — typically hardware devices kept offline — as opposed to hot wallets, which are online and used for day-to-day transactions. The idea is simple: funds that are never online cannot be stolen over the internet.

If the claim is accurate, it limits the damage an attacker could do through a server compromise, because the servers that were breached would not hold the keys to the bulk of customer funds. That is the standard defence for exchanges, and it is why Unocoin asked BitGo and Fireblocks to freeze its enterprise accounts on 6 November: those accounts hold the funds used for daily transactions, which are the most exposed.

But the claim has limits. First, it is a company statement, not an independently verified figure — Unocoin has not published a proof-of-reserves snapshot or an auditor's confirmation. Second, even 90% in cold storage leaves the remaining share in hot wallets and with custody providers, and the 12 November outgoing transactions from a BitGo-held Ethereum wallet show that the exposed part of the system was active during the incident. Third, cold storage protects funds, not access: even if every rupee of customer crypto is safe, users still cannot trade, withdraw or even log in while the servers are being rebuilt. Safety of funds and availability of funds are two different things, and this incident is a reminder of that.

What This Means for Indian Users

For Indian users, the Unocoin incident lands in a month that has already been hard for the country's crypto exchanges, and the practical consequences are immediate.

If you are a Unocoin user, you cannot access your account. Logins have been disabled since 9 November, and there is no announced date for them to return. The exchange estimates four to five working days to rebuild its systems, plus security validation — an estimate, not a promise. The website was returning errors on 12 November, and the exchange says its blog and X account are its only confirmed update channels.

The incident does not change India's tax rules. Gains on crypto assets in India are taxed at a flat 30% plus a 4% cess — 31.2% in total — with no set-off of losses against other income, and sales attract 1% TDS. A security incident at an exchange does not change those rules, and any loss of crypto would have its own tax treatment that depends on the facts. Tax note: crypto tax rules can change — the 30% rate and 1% TDS described here were current as of September 2026. Verify the latest rules before filing.

The regulatory context is relevant. Unocoin is a registered entity with India's Financial Intelligence Unit, as Indian exchanges must be, and the incident follows a month of enforcement attention on the sector: the Enforcement Directorate's searches at CoinDCX and Delta Exchange in early November over alleged offshore routing of trades, and the CoinDCX hack in late October. None of those are the same as the Unocoin incident — different exchanges, different facts — but together they describe a sector under simultaneous pressure from attackers and from regulators, and users should expect scrutiny of Indian exchanges to continue.

The product angle matters too. Unocoin launched UnocoinXPledg, its bitcoin-backed lending product, on 29 October — two weeks before the breach was detected. The product lets users borrow rupees against their bitcoin. With all services suspended, that product is suspended too, and users with outstanding loans will need to watch for the exchange's guidance on how loan positions are treated during the outage. The exchange has not yet published that guidance.

Bitcoin's rupee price is unaffected by the incident itself. Bitcoin traded near $73,600 on 12 November, roughly ₹69 lakh per coin at the current exchange rate. The Unocoin incident is a company-specific security event, not a market event, and it does not change the price of bitcoin. What it changes is access: Indian users who held funds on Unocoin cannot reach them until the exchange reopens.

What Unocoin Users Should Do Now

A short, practical checklist for anyone with an account on the exchange:

1. Ignore unsolicited offers to recover your funds or restore your account. Exchange outages attract scammers who pose as support staff and offer to "help" for a fee, or send links to fake login pages. Unocoin has said its blog and X account are its only confirmed update channels. Any other message offering recovery help should be treated as a scam.
2. Never share your seed phrase, private keys or one-time passwords. No legitimate exchange support team will ever ask for them — including anyone claiming to be Unocoin support. If someone asks, it is a scam.
3. Keep your own records. Save screenshots of your holdings, deposit and withdrawal history, and any emails from Unocoin, so you have your own account of what you held and when. If there is a dispute later, your own records are your evidence.
4. Do not try to log in through unofficial links. If the official website is returning errors, wait for the exchange's own announcement rather than following links from social media or messaging apps.
5. Check the exchange's own channels once a day, not once an hour. The rebuild is estimated at four to five working days, and there will be long stretches with no new information. Checking the official blog and X account once a day is enough, and it reduces the chance of acting on a rumour.
6. Think about how you hold crypto in future. This incident is a reminder that funds on any exchange are funds you cannot reach while that exchange is down. Self-custody — holding your own keys in a wallet you control — has its own risks, including losing your keys, but it removes the exchange-outage risk entirely. That is a decision for each user to make with full information, not a recommendation to move funds in a hurry.

The Bigger Picture: A Hard Month for Indian Exchanges

The Unocoin breach is the third major Indian-exchange story in three weeks, and the pattern is worth noting without overstating it.

On 26 October, CoinDCX confirmed a security incident involving a $16 million loss. On 4–5 November, the Enforcement Directorate searched premises linked to CoinDCX and Delta Exchange over alleged unauthorised cross-border trades. On 6 November, Unocoin detected suspicious activity on its own systems. Three different exchanges, three different kinds of problem — a hack, an enforcement action, and a server compromise — but all in the same fortnight, and all affecting Indian users' access to their money.

The common thread is not a single attacker or a single failure. It is that Indian crypto users are exposed to the operational health of a small number of exchanges, and that when one of them goes down, users have limited recourse: no deposit insurance, no regulator hotline that restores access, and no published service-level guarantee. The Financial Intelligence Unit registration that Indian exchanges hold is an anti-money-laundering registration, not a guarantee of solvency or security. Users who treat an exchange account like a bank account — assuming the money is always reachable — are making an assumption the last three weeks have not supported.

None of this is an argument against using exchanges. They are how most Indians buy and sell crypto, and they provide services — rupee on-ramps, order books, custody — that most users cannot replicate themselves. It is an argument for understanding what an exchange is: a company holding your assets on your behalf, whose systems can fail, whose servers can be compromised, and whose services can be suspended for days while it rebuilds. That understanding is the difference between being surprised by an outage and being prepared for one.

What to Watch Next

Three things, all of them data rather than predictions, will show how this incident resolves.

• The next Unocoin update. The exchange has promised more information as its investigation progresses. The next update should answer the questions the 12 November statement left open: how access was gained, which systems were affected, and — most importantly — a verified figure for any loss and the status of customer holdings. A proof-of-reserves snapshot or an auditor's statement would carry far more weight than another reassurance.
• The rebuild timeline. Four to five working days from 12 November points to roughly 18–19 November for the rebuild, plus security validation. Whether services actually return around then, or whether the timeline slips, will be the first concrete test of the exchange's handling of the incident.
• Any regulatory response. India's Financial Intelligence Unit and other authorities have not yet commented publicly on the Unocoin incident. Whether they ask questions, request information, or issue guidance will show whether this is treated as a company matter or a sector matter.

None of these is a signal to act on by itself. They are the facts to watch while the exchange is offline, and they are the facts that will determine whether this incident is remembered as a contained outage or as something larger.

The Bottom Line

On 9 November 2026, Unocoin — one of India's oldest crypto exchanges, operating since 2013 with more than 2.5 million users — detected unauthorised access to its servers and disabled user logins. On 12 November it confirmed its infrastructure had been compromised, detected outgoing transactions from an Ethereum wallet held with BitGo, and said it is rebuilding its server systems from scratch, estimating four to five working days plus security validation. No loss figure has been confirmed, no reopening date has been given, and blockchain data showing about 81,000 Unocoin-attributed addresses with a displayed value of zero has not been explained or independently linked to the breach. The exchange says over 90% of customer crypto is in cold storage and no funds have been lost, but it has also said it cannot yet establish the full status of customer holdings. For Indian users, the practical points are that accounts are inaccessible, that unsolicited recovery offers should be ignored, that seed phrases and passwords should never be shared, and that the tax rules — 30% plus a 4% cess, with 1% TDS — are unchanged. The incident is the third major Indian-exchange story in three weeks, and it is a reminder that funds on any exchange are only as reachable as that exchange's systems.

Keep Learning

• Bitcoin-Backed Loans in India: Borrow Against Your Bitcoin — Unocoin's own lending product, launched two weeks before the breach, and how bitcoin-backed loans work.
• ED Searches CoinDCX and Delta Exchange Over Offshore Trades: FEMA Explained — the other big Indian-exchange story of the month, and what the FEMA investigation means for users.
• CoinDCX Hack Explained: What Happened and Is Your Money Safe? — the late-October CoinDCX security incident, and the same questions about funds, cold storage and exchange safety.