On this page
Key takeaways
- Indian exchange Unocoin says it found suspicious activity on November 6, suspended its services after further activity on November 9, and confirmed that its infrastructure had been compromised.
- Its November 12 update says outgoing transactions from an ETH wallet address are being investigated. Unocoin says it cannot yet establish the full transaction picture or complete status of customer holdings.
- Unocoin says over 90% of customer crypto is kept in cold storage. That is a company statement, not independent proof of reserves or a confirmed loss figure.
- The company estimates rebuilding its systems will take four to five working days. That is not a guaranteed reopening date. Ignore unsolicited offers to recover funds or restore account access.
Unocoin says its infrastructure was compromised and its services are suspended. A November 12 statement from the Indian exchange describes wallet transactions still being investigated and leaves the amount of any cryptocurrency loss unresolved. An earlier assurance that no loss had been identified should not be read as a current all-clear.
What Unocoin has confirmed
According to Unocoin's latest incident statement (opens in a new tab), the first suspicious activity was detected on November 6. The company says it requested freezes on enterprise accounts at its custody providers as a precaution. It reports that no missing crypto had been identified at that initial stage.
The statement then describes more unauthorized activity on November 9. Unocoin says it suspended all services and subsequently established that its infrastructure had been compromised. It is still investigating which systems were reached and whether information was exposed.
On November 12, the company says it identified outgoing transactions from an ETH address used in its wallet infrastructure. It says it has escalated that finding to the relevant custody provider and is seeking transaction details. This article does not establish that provider's fault or independently verify Unocoin's account of those discussions.
What remains unknown
The crucial distinction is between a confirmed server compromise and a quantified loss. Unocoin's statement confirms the former, but does not give a verified total for the latter. It says frozen accounts and wallet-address mechanics limit its ability to reconstruct all potentially unintended transactions.
Unocoin also says more than 90% of customer cryptocurrency is in cold storage. That is the company's figure. It is not an independent audit, a full reconciliation of holdings, or a promise that every customer balance is unaffected.
The root cause, full sequence of events, extent of any data exposure and complete status of the cryptocurrency remain under investigation, according to the company. Those are the specific missing facts that would change this story.
Why a wallet dashboard is not the answer
crypto.news reported (opens in a new tab) the website disruption and attention around an analytics dashboard displaying no assets in wallets associated with Unocoin. The outlet also explained the limitation: attributed addresses need not capture an exchange's entire holdings.
We are not treating that screen as proof that all reserves disappeared. Nor are we carrying forward the older no-loss reassurance from that coverage: Unocoin's newer statement describes transactions still being checked. A company update and an analytics screenshot answer different questions, and neither supplies a verified loss total here.
Restoration is an estimate
Unocoin says it will recreate its server environment rather than restore the compromised one. It estimates that work at four to five working days and says security checks must precede bringing services back. The estimate is not a fixed reopening appointment, and readers should not calculate a promised withdrawal date from it.
What this means for you
This is an incident at an exchange serving India, not a newly available US product or evidence of a compromise at US exchanges. For US readers, the practical lesson is about custody: when a platform controls the keys, your ability to use its balance also depends on its systems and service access. Our wallet guide explains the difference from self-custody.
- If you have an affected account: keep your account records and check updates through independently verified company channels. Treat restoration times and reserve statements as provisional until the company reconciles them.
- Do not pay an unsolicited helper. The FBI warns (opens in a new tab) that fake recovery lawyers impersonate legitimate firms and government partners to extract more money from victims.
- Never give a stranger your recovery phrase. An account-restoration message is not a reason to reveal wallet secrets or sign an unexplained transaction. Our recovery-scam guide covers the warning signs.
This report reflects the public material checked on November 12, 2026. It is education, not a recommendation to use an exchange or trade a token.
Frequently asked questions
Has Unocoin confirmed how much was stolen?
Its November 12 statement does not give a verified loss total. It describes outgoing wallet transactions under investigation and says it is still establishing the status of all customer cryptocurrency.
Does a zero balance on an analytics dashboard prove all funds are gone?
No. crypto.news notes that the addresses a dashboard attributes to an exchange may not represent all its holdings. Unocoin's November 12 statement says it also lacks complete visibility into the transactions being investigated.
When will Unocoin reopen?
The company estimates four to five working days for rebuilding its infrastructure, followed by security validation before service restoration. It has not supplied a firm reopening date in the statement reviewed for this article.
Is this an instruction for US customers of other exchanges?
No. The statement concerns Unocoin, which serves the Indian market. It does not establish a security problem at any US exchange; the useful general lesson is to distinguish an exchange's account balance from independently verified access to the underlying assets.
Sources
Published November 12, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.