We wish to inform our customers and stakeholders that Unocoin is currently investigating a security incident involving unauthorised activity detected on Friday, 6 November 2026.

1. Initial Detection and Immediate Security Measures

Upon identifying the suspicious activity, we immediately initiated precautionary measures to safeguard our cryptocurrency holdings and prevent any unauthorised transactions.

As part of these measures, we requested an immediate freeze of our enterprise accounts with BitGo and Fireblocks, which hold cryptocurrency balances required to facilitate our day-to-day crypto transactions.

The account freezes were initiated at the following times:

• Fireblocks: 6 November 2026 at 11:24 UTC
• BitGo: 6 November 2026 at 11:29 UTC

We subsequently sought explicit confirmation from both service providers that the accounts had been successfully frozen and that no further transactions could be initiated using their platform. We received confirmation from both providers. Cryptocurrencies are not kept on any of our servers directly.

At the time of these initial security measures, no loss of cryptocurrency funds had been identified.

2. Further Unauthorised Activity and Suspension of Services

Despite rechecking and strengthening several apparent and assumed vulnerabilities within our infrastructure, we detected further unauthorised activity on Monday, 9 November 2026.

Given the circumstances and in the interest of protecting customer assets and data, we took the precautionary decision to suspend all Unocoin services immediately.

Our investigation subsequently established that our infrastructure had been compromised. The full extent of the compromise, including the systems accessed and the information potentially exposed, is still being investigated.

3. Infrastructure Restoration

As a precautionary measure, we have decided to rebuild our entire server infrastructure from the ground up rather than attempt to restore the existing environment.

This process involves recreating and securing the infrastructure before resuming operations. We currently estimate that this exercise will take approximately 4–5 working days.

The exact root cause of the incident and the complete sequence of events leading to the compromise have not yet been established. Our investigation is ongoing.

4. Additional Finding – BitGo Wallet Activity (12 November 2026)

On 12 November 2026, we identified outgoing transactions that has happened from one of the ETH addresses in our BitGo wallet infrastructure, which we used to fund ERC-20 tokens.

We immediately escalated this finding to BitGo, and their team has initiated an investigation into how these transactions could have been executed. BitGo has confirmed that the matter is being treated as a priority, and we are awaiting their findings.

There are certain technical and operational limitations affecting our ability to establish the complete extent of these transactions at this stage:

• Our BitGo enterprise accounts remain frozen.
• We are currently unable to log in to the frozen accounts.
• A significant part of BitGo’s wallet architecture uses change addresses when processing cryptocurrency transactions. So we cannot fully check on blockchain as well.

Consequently, we currently do not have complete visibility into all potentially unintended transactions across our BitGo wallets. We have requested the necessary transaction-level details and clarification from BitGo to establish the full picture.

We will provide further information as soon as these details become available and have been verified.

5. Status of Customer Cryptocurrency Funds

More than 90% of the cryptocurrency funds held on behalf of our customers are maintained in cold storage.

Protecting customer assets remains our highest priority. We are continuing to work closely with our infrastructure and custody partners to establish the complete status of all cryptocurrency holdings and investigate any potential exposure.

6. Ongoing Investigation and Next Steps

Our immediate priorities are:

• Completing a comprehensive investigation to establish the root cause and sequence of events.
• Determining the full extent of the infrastructure compromise and any potential data exposure.
• Working with BitGo and Fireblocks to establish the complete status of our cryptocurrency holdings and investigate any unintended transactions.
• Rebuilding our server infrastructure with enhanced security controls.
• Conducting comprehensive security checks and validation before restoring services.

We understand the concern and uncertainty that an incident of this nature may cause to our customers and other stakeholders. We remain committed to communicating transparently as the investigation progresses.

We will share further updates as additional findings are established, the extent of the impact and our operational restoration plans.

Safeguarding the interests of our customers, employees and all other stakeholders continues to be our foremost priority.

Team Unocoin

E-mail id: [email protected]
Other links: linktr.ee/unocoin
Contact details: 7788978910 (09:30 AM IST – 06:30 PM, Mon-Sat)