Unocoin says the custody freeze it ordered at BitGo on Nov. 6 worked, and that the transfers it found leaving one of its BitGo Ethereum addresses were signed outside BitGo’s platform altogether. In an update on Friday, the Indian exchange said a backup mechanism built into BitGo’s multisignature wallets “seems to be exploited,” and that it still cannot say whether it lost any crypto or how much.
What Unocoin said on Friday
The exchange added the new section to its security incident update after it received what it called all the needed information and clarifications from BitGo. “Technically, transactions in question have got signed and broadcasted externally on-chain directly without BitGo’s platform or involvement,” Unocoin wrote.
It explained that BitGo multisignature wallets are set up so that the customer can still reach its funds if BitGo ever disappears. Unocoin said it is now investigating how that backup path was used, whether any crypto was lost and what it means for the privacy of customer information.
That is a shift from Thursday, when Unocoin first disclosed outgoing transactions from an ETH address it used to fund ERC-20 tokens and said BitGo was investigating how they could have been executed. The question was then whether the BitGo freeze had failed. Unocoin now says it did not.
Why a freeze did not stop the transfers
BitGo wallets use a 2-of-3 key model: a user key, a backup key and a BitGo key. Normal transactions are signed with the user key and BitGo’s key, and the backup key is kept for disaster recovery, according to BitGo’s support documentation. If BitGo is unavailable, the customer can sign with its user and backup keys alone.
BitGo offers a free tool for exactly that, the Wallet Recovery Wizard. Its developer documentation says the tool lets customers withdraw assets “without BitGo” using the user key and backup key, and that “recovery transactions bypass any policies you have with BitGo.” To use it, a wallet holder needs the key material plus the wallet passphrase.
A freeze on BitGo’s side blocks the normal signing path because BitGo stops co-signing. It cannot block a transaction signed with the other two keys and broadcast directly to Ethereum. That design is meant to protect customers from being locked out if their custodian fails. In Unocoin’s case, the exchange is investigating whether someone with access to its key material used the same escape hatch.
Unocoin has not said how the attacker could have obtained the user and backup keys or the passphrase, or where those were stored. It said earlier that its own infrastructure had been compromised and that it is rebuilding its servers from scratch.
Timeline of the Unocoin incident
According to Unocoin, it first detected unauthorized activity on Nov. 6 and asked Fireblocks and BitGo to freeze its enterprise accounts that day. Those freezes went in at 11:24 UTC and 11:29 UTC, the exchange said, and both providers confirmed them. No loss had been identified at that point.
Further unauthorized activity on Nov. 9 led Unocoin to suspend all services. Before that, crypto withdrawals had already been paused for what the exchange called system maintenance. The exchange estimated the server rebuild would take four to five working days. On Nov. 12 it found the BitGo transfers and said it could not size them because its BitGo accounts were frozen, it could not log in and BitGo’s use of change addresses made the activity hard to trace on-chain.
Unocoin says more than 90% of the crypto it holds for customers is in cold storage and that it does not keep crypto on its own servers. It has not given a date for restoring services. Unocoin and BitGo did not respond to requests for comment from Cointelegraph, which also noted a Nov. 5 warning from India’s cybersecurity agency about an AI-assisted campaign targeting crypto exchanges. No link between that warning and Unocoin has been established.
What to watch
The open questions are how much left the BitGo wallet, whether other wallets set up the same way were touched and how the backup key material was exposed. For BitGo, the finding points away from a failure of its freeze. For other exchanges that self-manage BitGo backup keys, it is a reminder that the recovery path sits outside the custodian’s controls by design, so the security of those keys is the exchange’s own problem.
FAQ
Did BitGo’s freeze fail at Unocoin?
Unocoin says no. It said BitGo froze its enterprise account on Nov. 6 as instructed and the freeze worked, but the transactions under investigation were signed and broadcast on-chain without going through BitGo.
What is the BitGo backup mechanism?
BitGo wallets need two of three keys to sign. Customers can use their user key and backup key, through BitGo’s Wallet Recovery Wizard, to move funds without BitGo, a feature designed for cases where BitGo is unavailable.
Have Unocoin customers lost funds?
Unocoin has not said. It is still working to establish whether crypto was lost and how much, and says more than 90% of customer crypto is in cold storage.
Disclaimer: This article is for informational purposes only and does not constitute financial advice.
