BitGo has said its systems were not breached in the Unocoin incident, with its review finding that outgoing transactions were signed using two keys held by the Indian exchange after its account was frozen on Nov. 6.
Summary
- BitGo says Unocoin’s account freeze worked and its signing key was never used in the transfers.
- Unocoin held two of the three keys in its self-custody wallet setup, according to BitGo.
- The exchange is investigating suspected misuse of a backup mechanism while working to restore services.
BitGo, in a Nov. 13 statement shared on X, said the transactions were signed with Unocoin’s user and backup keys and broadcast directly on-chain without its participation. The company said no other clients were affected and directed questions about customer funds to Unocoin.
The statement follows the exchange’s disclosure of outgoing transactions from an Ethereum address within its BitGo wallet infrastructure. Unocoin identified the activity on Nov. 12, several days after requesting freezes on accounts used for its daily cryptocurrency transactions.
BitGo says Unocoin held the two keys used to sign
According to BitGo, Unocoin’s wallets use a 2-of-3 self-custody arrangement. Unocoin holds the user key and backup key, while BitGo holds the third. Two keys are needed to authorize a transaction, and the company said its own key was never used in the transfers under review.
BitGo’s wallet documentation describes the same signing structure. Normal transactions use the user key and BitGo key, but a backup key can be combined with either of the other two keys to complete the required signatures.
For self-custody wallets, the documentation says BitGo does not have access to the private user or backup keys. Clients create their keys on their own side and provide an encrypted user key and public backup key to the platform.
Its separate recovery instructions describe how funds can be recovered without using BitGo services. The process creates a fully signed transaction that can then be broadcast through a blockchain explorer. Ethereum and ERC-20 token recoveries are covered in the guide.
The instructions list the encrypted user key, backup key, wallet passphrase and destination address among the recovery inputs. For Ethereum, users must supply the wallet contract address, with a separate token contract address required for ERC-20 assets.
Unocoin suspects the wallet backup mechanism was exploited
In its updated incident notice, Unocoin said on Nov. 13 that it had received the information and clarifications requested from BitGo. The exchange acknowledged that the freeze appeared to have worked and that the transactions were signed and broadcast outside the provider’s platform.
Unocoin said the wallet design preserves access to cryptocurrency if BitGo becomes unavailable. It suspects this backup mechanism was exploited and is investigating how it was accessed, any cryptocurrency loss, and possible exposure of private information.
The exchange’s account of the investigation has developed since its initial disclosure. On Nov. 12, it said frozen account access prevented it from reviewing the complete transaction history through BitGo. It had requested transaction-level information after identifying transfers from an ETH address used to fund ERC-20 tokens.
Neither the supplied BitGo statement nor Unocoin’s Nov. 13 clarification names the person who used the keys or gives a confirmed loss figure.
Earlier disclosures described server access and service disruption
As crypto.news previously reported, Unocoin had disabled customer logins following unauthorized server access disclosed on Nov. 9. Its website was returning a 504 Gateway Time-out error on Nov. 12.
That coverage cited Onchain Lens, which said Arkham Intelligence displayed zero holdings across roughly 81,000 addresses associated with the exchange. Unocoin had maintained that no customer funds were lost when it first announced the login suspension.
In its subsequent security notice, the exchange said suspicious activity was first detected on Nov. 6. It requested a Fireblocks account freeze at 11:24 UTC and a BitGo freeze at 11:29 UTC, receiving confirmation from both providers.
After detecting further unauthorized activity on Nov. 9, Unocoin suspended all services. Its investigation established that its infrastructure had been compromised, according to the exchange, while the systems accessed and information potentially exposed remained under review.
Unocoin said more than 90% of customer cryptocurrency was held in cold storage. It estimated that rebuilding and securing its server infrastructure would take four to five working days, with security checks and validation required before services resumed.
