The following timeline provides a chronological record of the security incident, precautionary measures taken, investigation findings and infrastructure restoration efforts.

Our investigation is ongoing. We will continue updating this page as new information is verified and confirmed.

Incident Timeline

6 November 2026 – Initial Detection

Status: Precautionary measures initiated

• Unocoin detected suspicious and unauthorised activity involving its infrastructure.
• Immediate precautionary measures were initiated to safeguard cryptocurrency holdings and prevent unauthorised transactions.
• An immediate freeze of the Fireblocks enterprise account was requested at 11:24 UTC.
• An immediate freeze of the BitGo enterprise account was requested at 11:29 UTC.
• Both Fireblocks and BitGo confirmed that their respective accounts had been successfully frozen.
• At the time of these initial security measures, no loss of cryptocurrency funds had been identified.

7–8 November 2026 – Security Monitoring

Status: Investigation ongoing

• We continued its security response following the initial detection and precautionary account freezes.
• The investigation into the suspicious activity remained ongoing.

9 November 2026 – Further Unauthorised Activity Detected

Status: All platform services suspended

• Despite rechecking and strengthening several apparent and assumed vulnerabilities within its infrastructure, We detected further unauthorised activity.
• In the interest of protecting customer assets and data, Unocoin immediately suspended all platform services.
• User logins and platform activities were temporarily disabled as a precautionary measure.
• Subsequent investigation established that Unocoin’s infrastructure had been compromised.
• The full extent of the compromise, including the systems accessed and any information potentially exposed, remained under investigation.

10–11 November 2026 – Investigation and Security Assessment

Status: Investigation ongoing

• We continued examining the compromised infrastructure and assessing the extent of the security incident.
• The investigation focused on identifying the root cause, understanding the sequence of events and determining the systems potentially affected.

12 November 2026 – Additional Finding: BitGo Wallet Activity

Status: Additional investigation initiated with BitGo

• We identified outgoing transactions from one of the ETH addresses within its BitGo wallet infrastructure, which was used to fund ERC-20 tokens.
• The finding was immediately escalated to BitGo.
• BitGo initiated an investigation into how these transactions could have been executed and confirmed that the matter was being treated as a priority.
• Unocoin’s BitGo enterprise accounts remained frozen.
• Unocoin was unable to log in to the frozen accounts to independently examine the complete transaction history.
• Certain technical and operational limitations relating to BitGo’s wallet architecture, including the use of change addresses, affected the ability to establish the complete transaction history through independent blockchain examination.
• We requested the necessary transaction-level details and clarification from BitGo to establish the complete picture.
• The extent of potentially unintended transactions remained under investigation.

12 November 2026 – Decision to Rebuild Server Infrastructure

Status: Infrastructure rebuilding planned

• As a precautionary measure, we decided to rebuild its entire server infrastructure from the ground up rather than attempt to restore the existing environment.
• The rebuilding process involves recreating and securing the infrastructure before resuming platform operations.
• The estimated time for this exercise is approximately 4–5 working days.
• Comprehensive security checks and validation will be conducted before services are restored.

12 November 2026 – Customer Cryptocurrency Holdings

Status: Complete holdings assessment ongoing

• More than 90% of customer cryptocurrency funds are maintained in cold storage.
• We continue working with its infrastructure and custody partners, BitGo and Fireblocks, to establish the complete status of cryptocurrency holdings.
• The investigation into potential exposure and unintended wallet transactions remains ongoing.

13 November 2026 – BitGo Clarification and Further Investigation

Status: Investigation ongoing

On 13 November 2026, Unocoin received the required information and clarifications from BitGo regarding the wallet activity identified on 12 November.

Based on the information received:

• BitGo confirmed that Unocoin’s enterprise accounts had been frozen as instructed on 6 November 2026.
• The account freeze is so far understood to have functioned as intended.
• The transactions in question were technically signed and broadcast externally on-chain, directly without using BitGo’s platform or involvement.
• BitGo’s multisignature wallets are designed with a backup mechanism that allows access to cryptocurrency funds even if BitGo becomes unavailable.
• This backup mechanism appears to have been exploited, and Unocoin is investigating how it was accessed and used.

Current Priorities

Unocoin’s immediate priorities remain:

1. Completing the investigation: Establishing the root cause and understanding how the unauthorised activity occurred.
2. Assessing the impact: Determining the full extent of the infrastructure compromise and any potential data exposure.
3. Establishing cryptocurrency holdings: Working with BitGo and Fireblocks to verify the complete status of cryptocurrency holdings.
4. Investigating wallet activity: Examining how the backup mechanism associated with BitGo’s multisignature wallets was accessed and used, and establishing any resulting cryptocurrency loss.
5. Rebuilding infrastructure: Recreating the server infrastructure from the ground up with enhanced security controls.
6. Security validation: Completing comprehensive security checks before restoring platform services.

Our Commitment to Users

We understand the uncertainty and concern this situation has caused our customers.

We recognise the responsibility that comes with safeguarding customer assets and maintaining the trust users have placed in Unocoin.

We are committed to sharing verified information as the investigation progresses. This timeline will be updated whenever significant new findings, security developments or service restoration milestones are established.

For further assistance:

Team Unocoin