Two cryptocurrency exchanges face fresh scrutiny over security and customer-asset protection following separate incidents. In today’s crypto roundup, blockchain intelligence firm Bitquery has identified a wallet potentially linked to Unocoin that lost approximately $182,270 in cryptocurrency, while Binance has reopened withdrawals on 87 blockchain networks and completed a new cryptographic proof of its reserves following October’s $6.34 billion security breach. The developments offer new evidence about Unocoin’s suspected wallet compromise and measurable progress in Binance’s recovery, although important questions remain unresolved in both cases.
Bitquery traces possible $182,270 Unocoin wallet theft
Blockchain analytics firm Bitquery has identified an Ethereum multisignature wallet potentially associated with Indian cryptocurrency exchange Unocoin, reporting that approximately $182,270 in assets left the address between November 9 and 11.
The investigation, with on-chain figures verified on November 13, identified 98 successful outgoing transfers involving Ether and 95 ERC-20 tokens. The wallet, 0x41ade1cd005741bd093b4df7391fdd8347dc42ee, appears to use a two-of-three multisignature structure consistent with BitGo’s wallet architecture.
Bitquery connected the wallet to Unocoin through an Ethereum deposit address previously identified in a public customer post from May 2018. According to the researchers, that address transferred funds to the suspected compromised wallet 53 times between 2018 and 2021.
The historical transactions provide evidence of a possible association, but Unocoin has not confirmed ownership of the identified wallet. The $182,270 figure is therefore an independently calculated estimate for one address, not an officially established exchange-wide loss.
The investigation builds on Unocoin’s November 13 disclosure of suspected BitGo wallet recovery misuse, when the exchange confirmed that outgoing transfers had been executed directly on-chain without BitGo’s platform participating in the transactions.
Unocoin detected suspicious infrastructure activity on November 6 and requested freezes of its Fireblocks and BitGo enterprise accounts at 11:24 UTC and 11:29 UTC, respectively. Both custodians confirmed the restrictions. Further unauthorised activity on November 9 prompted the exchange to suspend services and investigate a server compromise.
Bitquery’s reconstruction suggests that the BitGo account freeze operated as intended. The final transaction signed through BitGo’s normal process occurred on November 6, before the freeze, with no subsequent outgoing transaction requiring BitGo’s signature identified in the examined wallet.
Instead, researchers found that the wallet’s user key and backup key authorised all 98 successful transfers. In the two-of-three configuration, those signatures were sufficient to move funds without BitGo’s involvement.
The freeze worked, yet the assets could still move.
Bitquery identified 124 outgoing transaction requests initiated using the backup key, of which 26 failed. The activity contrasts with the wallet’s earlier history, during which the presumed BitGo signer handled routine transactions and the backup key remained unused.
Wallet transfers began minutes after Unocoin’s no-loss statement
The investigation identified a narrow timing discrepancy between Unocoin’s initial public assurances and the first suspicious wallet transfer.
At approximately 10:13 UTC on November 9, Unocoin published a statement indicating that no cryptocurrency funds had been lost. Bitquery reports that the first transfer from the suspected wallet occurred six minutes and 24 seconds afterward.
The backup-key address received a small amount of ETH to pay transaction fees 48 seconds before its first outgoing transaction. The attacker then reportedly removed ETH, BAT and USDT worth approximately $78,000 within the first minute of activity.
Six minutes, an uncomfortable interval, but the blockchain cannot explain why the activity began at that moment.
The timing does not establish that Unocoin knowingly issued an inaccurate statement. Its November 12 disclosure confirmed that the exchange subsequently identified unexpected outgoing wallet transactions, while its November 13 update acknowledged that the recovery mechanism appeared to have been exploited.
Bitquery’s tracing indicates that approximately 79% of the $162,000 in identifiable outgoing value reached CCE Cash, a cryptocurrency swap service that does not require conventional account registration. The researchers attributed approximately $128,000 in transfers to five intermediary addresses associated with the service.
Another 18,000 USDT reportedly reached Swapuz, while five ETH entered an address labelled as a KuCoin deposit destination and three ETH were transferred through LI.FI. These service identities rely on Bitquery’s address attribution, with the researchers expressing lower confidence in the Swapuz label.
The principal cash-out sequence took approximately 4.4 hours. Once the assets entered swap services, however, the investigation could not determine all subsequent recipients across other blockchain networks.
Bitquery’s $182,270 valuation also includes illiquid assets that may not have been saleable at their quoted market prices. Excluding three thinly traded tokens reduces the estimate to approximately $156,000. Another 34 tokens lacked usable market prices and were not included.
There is a seperate uncertainty surrounding the exchange’s total exposure. Unocoin says more than 90% of customer cryptocurrency holdings are kept in cold storage, but neither the reserve proportion nor the newly identified wallet history establishes the complete financial consequences of the incident.
Bitquery reported no corresponding suspicious activity among several other potentially associated wallets it examined. Its analysis did not cover all Unocoin custody arrangements, including the complete Fireblocks and cold-storage holdings.
Unocoin has not disclosed a final loss figure or confirmed whether the reported wallet is among the addresses under investigation. The exchange is rebuilding its server infrastructure and has not announced a firm date for restoring customer services.
Binance reopens withdrawals across 87 blockchain networks
Binance reported on November 14 that it had restored cryptocurrency withdrawals on 87 blockchain networks during the preceding week, advancing its operational recovery following the October 29 security breach that affected approximately $6.34 billion in digital assets.
The announcement, published at 03:52 UTC, lists networks including Avalanche, Cardano, Litecoin, Near, Cosmos, Filecoin, Polkadot-related infrastructure and several Ethereum scaling networks. Binance said it aims to restore withdrawals across all remaining networks and assets by the end of the following week.
The exchange cautioned that customers may continue experiencing temporary processing delays while withdrawal infrastructure is restored and transaction volumes increase.
The 87-network figure reflects networks reported as reopened during the week, including some previously restored services. It does not mean all 87 became avaliable simultaneously on November 14.
The update follows Binance’s initial withdrawal restart on November 1, when the exchange began reopening selected blockchain networks after suspending transfers to investigate the attack and rebuild affected systems.
Binance has separately confirmed that it completed replacing the cryptocurrency assets affected by the breach, committing more than $6.34 billion in company-controlled resources.
As documented in DaveFinances’ November 13 report on Binance’s asset replacement, the company funded the operation through its corporate treasury, part of the Secure Asset Fund for Users (SAFU), and Futures Insurance Fund resources exceeding its required risk-management levels.
Replacing stolen assets is distinct from recovering cryptocurrency controlled by the attackers. Binance had previously reported approximately $2.85 billion in frozen or intercepted digital assets, subject to reconciliation and market-price movements. Those assets cannot be counted as additional customer reimbursement.
Binance has also committed to rebuilding SAFU to approximately $1 billion, although the company has not disclosed the amount withdrawn from the fund or a completion date for its replenishment.
Assets replaced, withdrawals still partly restricted. The recovery has reached different stages across the exchange’s financial and operational systems.
Binance completes cryptographic proof covering 198 tokens
Binance announced another recovery milestone on November 14, confirming that the zero-knowledge proof associated with its November 12 proof-of-reserves snapshot had been generated.
The snapshot, taken at 00:00 UTC on November 12, covers 198 cryptocurrencies, compared with 44 tokens in the November 4 reserve review.
The company said users could independently verify its claimed minimum one-to-one reserve backing through the completed cryptographic proof. Generating the proof had been expected to require approximately 40 to 50 hours because of the computational workload.
The expanded coverage allows more eligible customers to check that their reported balances are incorporated into the reserve calculation and supported by the corresponding asset data.
But a completed cryptographic proof, an independant audit of the company’s finances it is not.
The Public Company Accounting Oversight Board’s Office of the Investor Advocate has previously warned in an investor advisory on proof-of-reserves limitations that reserve-verification reports do not provide the same assurance as financial statement audits. Such reports may not address all liabilities, asset encumbrances, internal controls or subsequent changes in holdings.
Binance’s cryptographic system provides a means to verify specified reserve data at a particular snapshot date. It does not independently establish that all corporate obligations have been settled, that SAFU has been fully replenished or that every customer can immediately withdraw assets.
Those seeking to recieve their cryptocurrency must still verify availability for the particular token and blockchain network involved. A token may be withdrawable on one network while transfers through another remain restricted.
The two investigations involve different security failures and financial exposures. Bitquery’s Unocoin analysis points to the potential misuse of recovery-signing credentials outside a custodian’s ordinary transaction controls, while Binance is reporting operational and reserve-verification progress after a much larger confirmed theft.
For Unocoin, the unresolved evidence concerns the identified wallet’s ownership, the extent of missing funds and how its signing credentials were accessed. For Binance, the remaining milestones are full withdrawal restoration, completion of emergency-fund replenishment and further verification of the exchange’s post-breach security controls.
Both cases illustrate the limits of relying on a single security assurance. A functioning account freeze cannot prevent transactions authorised through separate recovery credentials, and a verified reserve snapshot does not automatically establish that customers can move their assets without restrictions.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.