Unocoin claims over 90% of assets in cold storage amid ongoing investigation

The Indian cryptocurrency exchange Unocoin has suspended all services, including user logins, following a security incident detected on November 6, 2026. The exchange has begun rebuilding its infrastructure after detecting unauthorized activity on its platform.

Unocoin moved quickly to contain the potential breach, requesting Fireblocks to freeze its enterprise accounts at 11:24 UTC on November 6. Five minutes later, it sent the same request to BitGo, with both freezes confirmed shortly after the requests came in.

The situation escalated on November 9 when further unauthorized actions forced Unocoin to shut down every service on its platform. The exchange began investigating a potential compromise of its servers and estimated the system rebuild would take 4-5 working days.

BitGo's clarification

On November 12, Unocoin spotted some outgoing Ethereum transactions from its BitGo wallet infrastructure and escalated those transfers for review. The following day, BitGo released its findings, stating its systems had not been breached.

BitGo explained that Unocoin used a 2-of-3 multisig arrangement where any two signatures are enough to approve a transaction. The research points to a possible exploitation of the backup key mechanism within Unocoin's multisig setup, though this remains a working theory rather than a confirmed explanation.

Customer assets status

Unocoin claims that over 90% of customer assets are held in cold storage, meaning offline wallets not connected to the internet. The exchange also states there have been no confirmed losses so far, though it admits lacking full visibility into every transaction due to the complexity of change addresses.

The exchange attributes the tracing difficulties to change addresses, which receive leftover funds from transactions and can complicate tracking the full path of funds. Customers remain unable to access their accounts until the system rebuild is complete.

Broader implications

The incident highlights potential vulnerabilities in multisig wallet setups where two of three keys are controlled by the same organization. If the investigation confirms the backup key mechanism was exploited, other platforms with similar arrangements may need to reassess their key management protocols.

While Unocoin's cold storage claim suggests the bulk of user funds were outside the targeted hot infrastructure, the exchange still needs to account for every outgoing transaction, including those routed through change addresses, before confirming the final impact on customers.