India’s Unocoin Confirms Hack as 81K Wallets Show Zero Balances

TL;DR:

• Unocoin confirmed unauthorized access to its servers and suspended user logins after detecting security incidents on November 6 and 9, 2026.
• The analysis platform Arkham Intelligence shows approximately 80,986 addresses linked to Unocoin with a collective valuation of $0 as of November 12, 2026, without independent verification of a massive theft.
• The Bengaluru-based company is investigating outgoing transactions from an Ethereum address associated with Bitgo, while maintaining that more than 90% of its clients’ cryptocurrency funds remain in cold storage.

This Thursday, November 12, a security breach was confirmed in Unocoin’s servers, putting the Indian exchange in the center of the storm. Data from Arkham Intelligence shows at least 81,000 wallets attributed to the platform with a zero balance. Despite the temporary suspension of its operations, the firm maintains that no cryptocurrency funds belonging to its clients have been lost.

INDIA'S OLDEST CEX HACKED? 81K WALLETS SHOW $0

Unocoin reported unauthorized server access on November 9 and temporarily disabled user logins.

Meanwhile, Arkham shows $0 in holdings across its 81,000 tracked addresses, while its website is returning a 504 error.

We are… pic.twitter.com/vwmv57sgdn

— Onchain Lens (@OnchainLens) November 12, 2026

Founded in 2013 and headquartered in Bengaluru, Unocoin is among the oldest exchanges in India. This attack has raised questions in the sector about custody schemes, vulnerabilities in operational infrastructure, and the actual reach of public on-chain tracking tools.

According to the timeline released by the company, the issues began on November 6, 2026. That day, the technical team detected unauthorized activity and requested the preventive freezing of its corporate accounts at custody providers Fireblocks and Bitgo at 11:24 UTC and 11:29 UTC, respectively. According to market reports, both custody firms confirmed the application of the restrictions without any assets being identified as lost during that initial stage.

Three days later, on November 9, the detection of new suspicious activity led Unocoin to publish an official statement, suspend its services, and disable user logins. In that update, the company acknowledged that its infrastructure had been compromised, although it reiterated that no user cryptocurrency funds had suffered losses.

The Actual Reach of the Data Recorded on Arkham Intelligence

This Thursday, November 12, the blockchain monitoring account Onchain Lens pointed out an unusual reading on Unocoin’s dashboard within Arkham Intelligence. Approximately 80,986 addresses attributed to the entity showed a combined valuation of $0, accompanied by the message “No assets found”.

The publication of these figures fueled speculation on social media about a possible total emptying of the exchange’s reserves. However, a market report specifies that the attribution of addresses on Arkham does not necessarily reflect the entirety of Unocoin’s custody arrangements, especially if the assets were moved to wallets that are not yet publicly labeled.

According to analysis by industry experts, there are several plausible explanations for the zero balance of those addresses. The funds could have been relocated to untracked cold storage addresses, transferred defensively following the intrusion, or moved without authorization. The evidence available to date does not allow for a determination of which of these scenarios occurred.

Furthermore, historical data from Arkham over the last month indicates that this group of nearly 81,000 addresses only collectively held a few hundred dollars in cryptocurrency at most, recording a quarterly peak slightly above $250,000. Therefore, the zero balance in that specific set of labeled wallets does not by itself prove that the accounts of 81,000 clients have been emptied.

Investigation into Bitgo Transactions and Server Reconstruction

The security update issued by Unocoin on November 12 incorporated an additional technical element under review. The platform’s researchers identified outgoing transactions originating from an Ethereum address linked to its wallet infrastructure on Bitgo, previously used to fund operations with ERC-20 tokens.

The company escalated the case to the custodian Bitgo to conduct a joint audit of these movements. However, according to documentation cited in the report, the previous freezing of corporate accounts and limited visibility into Bitgo’s change-address mechanisms have made a complete reconstruction of the asset flow difficult.

At the same time, the company stated that more than 90% of its clients’ cryptocurrency funds remain safeguarded in offline cold storage systems. The incident occurs in a sensitive context for the Indian market, following previous breaches recorded at other local platforms such as WazirX and CoinDCX, which increases the demand for independent verification.

While the forensic audit progresses, Unocoin reported that it is completely reconstructing its server infrastructure, a technical process that will take between four and five business days according to the company’s official estimates. During this period, logins, trading operations, and withdrawals will remain suspended, while the official website shows Cloudflare 504 Gateway Timeout errors pending the publication of the final investigation report.