A backup key took about $182,000 in crypto from a BitGo wallet tied to Unocoin. The first transfer came six minutes after the exchange said no funds were lost.
Unocoin has not named the wallet that was hit. We searched Ethereum for one that matches, tied it to one user's old Unocoin deposit, followed the money to four exits, and looked for the thief's keys on nine other chains.
- 6 min
- $182K
- 2 of 3
- 79%
- 53
- 9
01 · What happenedThe Unocoin hack, traced on Ethereum
On 9 November, Unocoin told its users that no crypto funds had been lost. The Indian exchange had found intruders on its servers that day and switched off logins. Six minutes after the post, a wallet that fits Unocoin's own account of events began to empty.
Unocoin is one of India's oldest crypto exchanges. It opened in 2013 and lets people buy and sell bitcoin and other coins for rupees. On 6 November, it spotted suspicious activity and asked its wallet providers, BitGo and Fireblocks, to freeze its accounts. Three days later, it found intruders on its servers and shut down all services.
Unocoin has since said that someone moved money out of one of its Ethereum addresses, and that a backup mechanism in its BitGo wallets "appears to have been exploited". It has not said which address was hit, or how much left it.
Bitquery reads every transfer on Ethereum, so we looked for a wallet that matches. We found one. Between 9 and 11 November, a key that had never been used before emptied it of 96 assets worth about $182,000. Within hours, most of the money reached swap services that ask for no account. Unocoin has not confirmed that the wallet is its own. So we show what ties it to the exchange, and what we could not check.
02 · The walletHow a BitGo multisig wallet works
BitGo is a US company that builds wallets for exchanges and funds. Many of them are multisig wallets, short for multi-signature. A multisig wallet has several keys, and a payout needs more than one of them to sign.
BitGo's wallets have three keys, and any two can move the money. The customer holds the user key, and BitGo holds another. The customer, or a recovery firm it picks, keeps the third one, the backup key, apart for emergencies.
In daily use, the exchange signs with its user key. BitGo checks the request, adds its own signature and sends the payment. That is why a freeze works. When BitGo stops signing, payouts through its platform stop.
The backup key is the way around BitGo. It exists so a customer can still reach its money if BitGo goes offline. The same door is open to a thief who holds the user key and the backup key. BitGo's guide says the backup key's address is not normally funded, "other than for disaster recovery".
On Ethereum, each BitGo wallet is a smart contract, a small program that holds the coins and checks the signatures. The contract lists its three signers in public. So anyone can see which key sent each payout. We have traced stolen keys before, in the LootBot drain.
03 · The six minutesThe wallet began to empty six minutes after the post
The wallet we found opened on 17 May 2018. For eight years, one address sent every withdrawal from it, more than 10,000 in all. That address sits in the contract's third signer slot, where BitGo puts its own key.
The last of those payouts went out on 6 November at 07:18 UTC, four hours before Unocoin asked BitGo to freeze its account. No payout through BitGo followed. The freeze held.
On 9 November at 10:13 UTC, Unocoin posted on X that "no crypto funds have been lost". Less than six minutes later, an address that had never sent anything received a little ETH, Ethereum's own coin. The ETH was there to pay network fees, known as gas. That address sits in the contract's second signer slot, where the backup key goes.
Then the backup key sent its first transfer, a small test. Within the next minute, it took the ETH, BAT and USDT, a dollar stablecoin. The gap from Unocoin's post to the first transfer was 6 minutes 24 seconds.
A payout needs two signatures, and each one is on the chain. In all 98 theft transfers, the second signature belongs to the user key. That same key had signed the wallet's normal payouts since 2018. So whoever did this held the user key and the backup key, the two that sit outside BitGo.
The timing may be chance. The thief may also have read the post, or may still have been inside Unocoin's systems that morning. The chain cannot tell these apart.
The wallet had been quiet before the theft. Its October payouts stopped on the 17th. Nothing more left for 20 days, until one payment on 6 November. On 9 November, the backup key sent the wallet 117 payout requests in a day.
04 · The sweepWhat the thief took
The thief took the coins that are easiest to sell first. ETH, BAT and USDT worth $78K went out in the first minute. For the next three hours, nothing else left the wallet while the thief moved that money on.
At 13:33 UTC, the thief came back for the rest. In 48 minutes, 89 transfers moved every token that was left. Some requests failed and were sent again. Of the 124 requests the backup key sent, 26 failed.
In all, 96 assets left the wallet: ETH and 95 tokens. At the prices when each one moved, they were worth $182,270. The figure leaves out 34 tokens with no market price. It also includes three thinly traded tokens, FUN, MTL and QRL, that may not sell at their listed price. Without those three, the total is $156K.
The wallet held a little of almost everything, from SHIB and UNI to coins that stopped trading years ago. An exchange's token wallet looks like that after years of listings.
The thief kept watching the wallet. A small ETH deposit reached it at 13:29 UTC on 9 November, and the backup key took it the next morning. The last four tokens left on 11 November, 45 hours after the first transfer.
05 · The moneyWhere the stolen funds went
The thief's address held the money for only a few hours. It sold the tokens for ETH on decentralized exchanges, or DEXs, apps that swap one coin for another without an account. Then it sent the ETH and the stablecoins out through one-time addresses, each used for a single payment.
Most of the money went to CCE Cash, an instant swap service that needs no account. A customer sends in one coin and names an address, often on another chain, where the service pays out a different coin. Through 5 one-time addresses, CCE Cash received $128K, or 79% of what we traced. We met CCE Cash before, as an early exit in the iPhone wallet drains on TRON.
Another 18,000 USDT went to Swapuz, a similar service. That label comes from a single source in our data, so we are less sure of it.
Two smaller payments took other routes. One of 5 ETH reached a deposit address at KuCoin, a large exchange. KuCoin moved it to a hot wallet, one of its own working wallets, within 20 minutes. That deposit address also takes money from other one-time addresses, so it likely belongs to another swap service with an account at KuCoin. KuCoin can see whose account it is.
The other payment, 3 ETH, went into LI.FI, an app that routes money across chains. We have not followed it to the other side.
The four exits took $162K between them. That is less than the $182K the assets were priced at, because some tokens sold below their listed price or did not sell.
The address that paid for the thief's gas points the same way. A wallet our labels mark as CCE Cash had sent it 47.6 ETH on 3 November. It pays coins out to many addresses per day, as a swap service's payout wallet does. So the thief most likely got that first bit of gas from CCE Cash too.
From the first transfer to the last large payment, the cash-out took 4.4 hours. At 15:18 UTC, Unocoin replied to a worried user that "all user funds are entirely safe". The last large payment had left the thief's address half an hour earlier.
A swap service breaks the on-chain trail. Its own records still hold the next step. CCE Cash and Swapuz know which addresses they paid, and KuCoin knows its customer. Tether can also freeze USDT if a report reaches it in time. You can follow any address in this story with the Bitquery MCP.
06 · The linkWhat ties this wallet to Unocoin
Unocoin has not published an address, and no public source names this wallet. A user's deposit ties it to the exchange, and five things on the chain agree. Unocoin has not confirmed the link.
The deposit dates from May 2018. One Unocoin user wrote on X that a Zilliqa deposit had not shown up, and posted the transfer. It shows 1,060 ZIL sent to a deposit address. An exchange gives each user an address like this, then sweeps it into a main wallet. On the chain, this address names the emptied wallet as its parent. From 2018 to 2021, the address sent 53 transfers of nine tokens, and every one went to that wallet.
The chain adds five more things. First, the dates match. Payouts through BitGo stop on the day Unocoin says BitGo froze its account. The backup key takes over three days later, on the day Unocoin found intruders on its servers. A later update from Unocoin says the money left "one of the ETH addresses" in its BitGo setup, one used for ERC-20 tokens, the standard token type on Ethereum. This wallet held ETH and 95 such tokens.
Second, the wallet is the right age. It opened on 17 May 2018. Unocoin announced Unodax, its exchange for coins other than bitcoin, 13 days later. Early Unodax listings such as BAT, FUN, ZRX and OMG were all among the tokens taken.
Third, it works like an exchange's withdrawal wallet. It sent 2,164 withdrawals in 2021, at the top of the last bull market, and 310 this year. Many go to deposit addresses at other exchanges. Of 70 receivers we checked, 38 carry an exchange-deposit label in our data. Two are at CoinDCX, and one is at WazirX, both Indian exchanges.
Fourth, it keeps Indian hours. Since January 2025, 91% of its withdrawals went out during the Indian day, between half past six in the morning and half past eight at night. Almost none went out in the six hours after midnight.
Fifth, nothing else fits. We scanned Ethereum from 1 October to 13 November for wallets of this type that a new key began to empty. One other wallet changed sender on 5 November and moved two tokens. Its funding and its receiver do not match this case.
The deposit rests on one user's post, so we still call the link unconfirmed. Unocoin or BitGo could confirm or correct it in one sentence.
07 · What was leftWhat the thief did not touch
BitGo's key for this wallet also signs for at least three other wallets. One collects customers' token deposits and holds 3.0 ETH plus tokens, and another holds 7.6 ETH. Each has its own user key and backup key, and none of those backup keys has ever been used. As far as the chain shows, the thief had the keys to one wallet.
BitGo's automatic sweeps kept working through the shutdown. They move customer deposits from one-time deposit addresses into the main deposit wallet. The latest we saw carried 8,102 USDT on 12 November.
We also checked whether the thief used the same keys elsewhere. A key gives the same address on every Ethereum-style chain, and a matching one on Tron. On Tron and 8 other chains, the thief's address and all 8 user and backup keys of the four BitGo wallets have never been used.
On Bitcoin, two addresses tied to Unocoin still hold their coins. One is a wallet that gathers customer deposits, and our labels mark it as Unocoin's. The other holds change from payouts, and that link is our own inference.
One press claim needs care. A tracker's dashboard showed about 81,000 Unocoin addresses holding nothing, and some reports read that as a sign of a large drain. That tracker does not tie the wallets in this story to Unocoin, on Ethereum or on Bitcoin. An empty list says little about what was taken.
08 · The statementsWhat Unocoin said, and when
Unocoin has posted often since 6 November, and its wording has shifted. On 9 November, it said "no crypto funds have been lost". Later that day, a reply to a user said "all user funds are entirely safe". On 12 November, its blog said it had found money leaving one of its Ethereum addresses and could not yet trace it. A reply the same day said "no user funds have been lost".
On 13 November at 05:07 UTC, a reply still said "no crypto funds have been lost or compromised". Half an hour later, Unocoin's update said the backup mechanism "appears to have been exploited".
Those statements make two different claims. Money left this wallet, so "no crypto funds have been lost" cannot be true of it. "No user funds have been lost" can still be true. An exchange can cover a loss from its own money, and Unocoin says more than 90% of customer crypto sits in cold storage, wallets kept offline. The chain cannot show whose money it was.
Unocoin also says it could not log in to its frozen BitGo account to read the history, and that it asked BitGo for the details. Unchained reported the same on 12 November.
09 · The limitsWhat the chain cannot tell us
The chain shows which keys signed. It does not show who held them. We cannot say how the user key and the backup key were copied, or when. Unocoin says it saw suspicious activity on 6 November and found intruders on its servers on the 9th. If both keys, or the passwords that unlock them, were stored there, that would explain the theft. That is a guess.
We found no theft on 6 November in these wallets. Whatever Unocoin saw that day did not move coins out of them.
We saw no sign that BitGo itself was breached. Its key signed nothing after the freeze. The weak point was the two keys held outside BitGo.
We did not look at Unocoin's Fireblocks wallets or its cold storage, because their addresses are not public. For the same reason, we could check Tron, XRP and Litecoin only for the thief's keys.
10 · For usersIs Unocoin safe?
The chain alone cannot answer that. It does show three things. The loss we traced is about $182,000, small for an exchange that has run since 2013. The other wallets we could tie to Unocoin still hold their coins. Customer deposits kept reaching its deposit wallet during the shutdown.
The chain does not show the cold storage that Unocoin says holds most customer crypto, and it does not show how the keys got out. Until Unocoin names the wallet and the cause, users have to take its word for the rest.
Indian exchanges have lost far more in other cases. WazirX lost about $235 million from a multisig wallet in July 2024, and thieves took $15.99M in the CoinDCX hack in October.
For anyone who runs a multisig like this, the lesson is in the backup key. It is a second way to the same money, and a freeze at the provider does not cover it. Keep it offline, away from the servers that hold the user key. Watch its address too. If gas arrives there, treat it as an alarm.
11 · The methodHow we found the wallet
Nobody had published an address, so we searched for the pattern. A payout from a BitGo wallet on Ethereum always uses one of three known commands. We listed every such command from 6 to 13 November and kept the senders that were brand new. One of them began to empty a wallet on 9 November. We then read its signer list from a public node, and the sender is one of its three signers.
Each payout carries a second signature. We worked out which key made it in every theft transfer, and in five normal payouts from 2018 to 2026. All of them show the same user key.
To test the link to Unocoin, we looked for a user who had posted a deposit on X. A post from 2018 led to a deposit address, and we read its parent wallet from a public node.
We followed every transfer out of the wallet and out of the thief's address. We left out fake tokens that bots sent to that address, a trick called address poisoning. Dollar values use Bitquery's price for each token at the time it moved. Service names come from Bitquery's own labels.
The full Ethereum history is also sold as files, as the Ethereum dataset on the Bitquery Data Store. For cases like this one, we also run crypto investigation services.
Ethereum data was read up to 08:37 UTC on 13 November 2026. Other chains were checked later that day. Anything after that is not covered.
Unocoin has not confirmed that this wallet is its own. The link rests on the evidence in section 06.
The deposit address is tied to Unocoin by one user's public post from May 2018. We did not count how many other deposit addresses paid into the wallet.
Dollar values use the price of each token at the time it left the wallet. Another 34 tokens have no price and 2 are priced at zero, so they add nothing. One token, KPER, is left out because its last price is stale; at that price it would add $39,570.
We name the three keys by what they did. One sent the wallet's payouts for eight years, so it is BitGo's. One made the second signature on every payout we checked, so it is the user key. The third never acted before 9 November, so it is the backup key. We did not read the wallet's creation data.
The KuCoin, CCE Cash and Swapuz names are Bitquery's own labels. The Swapuz label has one source. The link from the gas wallet to CCE Cash comes from its payments, and it carries no label of its own.
We did not trace what the swap services paid out, or where the 3 ETH went after LI.FI. The thief also sent 0.24 ETH to three other addresses on 10 and 11 November.
The takeover scan reads direct calls to BitGo-style wallets. A wallet driven through another contract would not appear in it.
No Unocoin wallet on Tron, XRP or Litecoin is public, so those chains were checked for the thief's keys only. Unocoin's Fireblocks wallets and cold storage were not checked.
Links between wallets are money links and shared keys. They do not prove who controls a wallet, and the chain never shows how a key was copied.
12 · The recordThe addresses behind the theft
Follow the stolen funds in plain English
Every transfer in this story comes from Bitquery's Ethereum data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's money went, or which key sent a payout, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the Ethereum dataset.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell or hold any token or asset, or to use or avoid any exchange, wallet, custodian, bridge, protocol or service.
The findings describe transactions and balances observed on Ethereum, Bitcoin, Tron, BNB Chain, Polygon, Arbitrum, Optimism, Base, Avalanche, Gnosis and Linea between 6 and 13 November 2026. Attributions come from on-chain behaviour and Bitquery's own labels; they may be incomplete or incorrect and may be revised as more data becomes available. The link between the wallet described here and Unocoin rests on what the chain shows and on one user's public post, and has not been confirmed by Unocoin or BitGo.
References to Unocoin, BitGo, Fireblocks, CCE Cash, Swapuz, KuCoin, LI.FI, Tether, WazirX, CoinDCX or any other named project, company or service describe what the public record shows and what those parties have said in public. They are not statements about any party's intent, security practices, solvency or conduct, and nothing here asserts that any named party acted unlawfully or negligently or knew of the theft. The wallet that took the funds is described by its behaviour and attributed to nobody.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
Was Unocoin hacked?
Unocoin says it saw suspicious activity on 6 November 2026 and found intruders on its servers on 9 November. It also says money left one of its Ethereum addresses at BitGo. It has not named the address or the amount. We found a BitGo wallet that fits its account. One user's old Unocoin deposit address paid into it. A backup key emptied it of about $182,000 between 9 and 11 November.
How much was stolen in the Unocoin hack?
Unocoin has not given a figure. The wallet we traced lost 96 assets worth about $182,000 at the prices when each one moved. ETH and USDT made up 41% of that. We found no theft in the other wallets we could tie to Unocoin.
Was BitGo hacked?
We saw no sign of that. BitGo froze Unocoin's account on 6 November, and its key signed nothing afterward. The thief used the other two keys, the user key and the backup key, which are held outside BitGo. Both signatures are on the chain.
What is a multisig wallet?
A multisig wallet needs more than one key to approve a payout. A BitGo multisig wallet has three keys, and any two can move the money. That protects against the loss of one key. It does not protect against the theft of two.
What is a BitGo backup key?
The backup key is the third key of a BitGo wallet. It lets the customer reach the money with the user key if BitGo goes offline. Its job is recovery, so its address normally sends nothing. In this case, it sent 124 transactions in 45 hours.
Where did the stolen funds go?
The thief sold the tokens for ETH, then sent 79% of the traced money to CCE Cash, a swap service that needs no account. The rest went to Swapuz, to a KuCoin deposit address and into the LI.FI bridge. The last large payment went out 4.4 hours after the first transfer.
Is Unocoin safe?
The chain cannot settle that. The loss we traced is about $182,000, and the other wallets we tied to Unocoin were not touched. Unocoin says more than 90% of customer crypto is in cold storage, which we could not check. It has not yet said how the keys were taken.
Were other chains affected?
We found nothing outside Ethereum. The thief's address and the user and backup keys of four BitGo wallets have never been used on Tron or 8 other chains. Unocoin's wallets on other chains are not public, so we could check those chains only for the thief's keys.
Run the next investigation in minutes
Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain. Prefer to do it yourself? Connect the Bitquery MCP server to your AI assistant, pull the raw datasets, or query the chain directly with the Bitquery API.