Indian cryptocurrency exchange Unocoin is investigating whether a recovery feature in its BitGo multisignature wallets was used to move assets outside the custodian’s platform, even though its enterprise account had been frozen following a security incident. The exchange said on November 13 that the transactions under review were signed and broadcast directly on the blockchain without going through BitGo’s services.
Unocoin said BitGo had confirmed its account was frozen on November 6 as instructed and that the restriction appeared to function as intended. The exchange suspects the wallets’ recovery mechanism was exploited, but has not established how it was accessed, which signing keys were involved or whether cryptocurrency was lost. Deposits, withdrawals and other platform services remain suspended.
The updated explanation narrows the investigation. It points to a possible route around the ordinary wallet-service workflow, not proof that BitGo ignored the freeze or that its own infrastructure was breached. The transactions’ amounts, destinations and precise execution times have not been publicly disclosed.
Unocoin says wallet transfers bypassed BitGo’s platform
The exchange first detected unauthorised infrastructure activity on November 6 and asked Fireblocks to freeze its enterprise account at 11:24 UTC. It submitted a similar request to BitGo five minutes later, at 11:29 UTC. Both providers confirmed the freezes. Unocoin said it had not identified any cryptocurrency loss at that initial stage.
Further suspicious activity surfaced on November 9, prompting Unocoin to suspend all services and customer logins. Its subsequent investigation found that its servers had been compromised, although the company has not disclosed how the attackers entered or which internal systems they reached.
On November 12, Unocoin reported outgoing transactions associated with one Ethereum address in its BitGo wallet infrastructure, previously used to fund ERC-20 tokens. The announcement described a discovery made that day; it did not specify when every transaction actually occurred. The company initially lacked full visibility because the BitGo account freeze prevented logins and because wallet change-address arrangements complicated independent tracing.
Unocoin’s November 13 incident timeline says BitGo then provided the requested clarifications. Based on those findings, Unocoin concluded that signing and broadcasting had taken place externally, without BitGo’s participation. The exchange is still examining the recovery mechanism, the affected wallets and any resulting losses.
There is no public forensic report confirming who signed the transactions. Nor has Unocoin reported that the Fireblocks accounts experienced comparable transfers.
Recovery keys can operate beyond a custodian’s controls
BitGo’s published wallet documentation describes a common two-of-three signing design with a user key, a backup key and a BitGo key. Ordinary transactions can use the user and BitGo keys. In certain self-custody configurations, the user and backup keys can instead authorise a recovery transaction when BitGo is unavailable.
This is a deliberate continuity feature. A client need not lose access to cryptocurrency permanently if its service provider becomes unreachable. But transactions that are validly signed outside the provider’s system can also fall outside its account-level approval or freeze process. The blockchain verifies the signatures; it does not necessarily consult a custodian’s application-level restrictions before settling.
That architecture explains why two statements can both be true: BitGo’s enterprise account freeze worked, while assets associated with a wallet could still move by an external signing route. It does not show that Unocoin’s user and backup keys were stolen. The specific key material, custody configuration and circumstances of signing remain unverified.
The trade-off is familiar in crypto custody. DaveFinances examined Onramp’s two-of-three corporate custody structure, which distributes approvals across institutions. That offering differs from Unocoin’s setup, but both designs show why the identities and independence of signing parties matter as much as the number of signatures required.
BitGo also operates products beyond multisignature wallet services, including its Link account-connectivity platform for institutional trading desks. Link manages visibility and transfer workflows across exchanges; it should not be confused with the underlying recovery-signature process being investigated at Unocoin. A failure in one service cannot simply be inferred from another service’s architecture.
Losses and a reopening date remain unconfirmed
Unocoin says more than 90% of customer cryptocurrency holdings are maintained in cold storage. That proportion may limit exposure to assets held for day-to-day operations, but it is not a verified statement that every customer balance is unaffected. The exchange is still reconciling holdings across BitGo and Fireblocks and determining whether any unintended transfers caused a loss.
There is also a seperate question about data security. The company has acknowledged that its servers were compromised and says it is still investigating which information, if any, was exposed. Neither the scope of that compromise nor its relationship to the suspected recovery misuse has been established.
Rather than restore its existing environment, Unocoin decided to rebuild the server infrastructure from the ground up. It estimated four to five working days for that exercise when the plan was announced on November 12, but did not promise a reopening date. Services will resume after further testing and validation.
Other exchanges have reported different failures at the boundary between wallet security and operational controls. In September, Bitget attributed a $387.5 million loss to manipulation of its wallet backend, while maintaining that its signing keys were not stolen. That was an established loss with a seperate reported attack path; Unocoin has neither quantified a loss nor confirmed how its external signatures were produced.
For Unocoin customers, the unresolved facts are concrete: the value and timing of the transactions, whether any held assets are missing, which recovery credentials were accessible and when account services can safely restart. Unocoin’s latest disclosure explains why a platform freeze did not necessarily control all ways to authorise a wallet transaction. It does not yet establish who used the alternative route or the financial consequences.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.