Users of Indian exchange Unocoin have been locked out since November 9, and the incident has now reached custody: the exchange spotted outgoing transactions from an ETH address in its BitGo wallet infrastructure. The address was used to fund ERC-20 tokens, and BitGo has opened its own investigation.

Unocoin first detected unauthorized server access on November 6 and froze its enterprise accounts at BitGo and Fireblocks the same day. Further unauthorized activity on November 9 led it to suspend all logins and services. The exchange has not disclosed how much ETH moved or where it went, saying the account freeze prevents it from viewing all of the transactions.

Unocoin says more than 90% of user crypto sits in cold storage and that no user funds have been lost.

The exchange is rebuilding its server infrastructure from scratch, a process expected to take 4 to 5 business days. The cause of the breach, its full impact and any data exposure remain under investigation, and no comprehensive incident report has been published yet.