Indian cryptocurrency exchange Unocoin has confirmed approximately $200,000 in cryptocurrency losses after attackers compromised backup signing keys associated with its BitGo multisignature wallets. The exchange disclosed on November 14 that three operational hot wallets were affected, providing its first estimate of the financial damage from a security incident detected eight days earlier.
Unocoin said it would cover the losses using its own resources rather than deduct funds from customer balances. It also reported that a portion of the affected cryptocurrency had been frozen through coordination with industry partners, although it did not disclose the amount recovered or restricted.
The disclosure follows BitGo’s November 13 technical investigation, which established that unauthorized Ethereum transfers were signed using two keys controlled by Unocoin. BitGo’s own signing key was not involved, and the transactions were broadcast directly to the blockchain outside its platform. BitGo said its infrastructure had not been breached and other customers were unaffected.
The new findings establish how the unauthorized transactions were approved and confirm that Unocoin’s backup keys were compromised. The precise method by which attackers obtained usable signing credentials remains under investigation.
Three hot wallets compromised despite account freeze
Unocoin initially detected suspicious infrastructure activity on November 6 and requested freezes on its enterprise accounts with Fireblocks at 11:24 UTC and BitGo at 11:29 UTC. Both providers confirmed the restrictions. The exchange had not identified cryptocurrency losses at that stage.
Further unauthorized activity emerged on November 9, prompting Unocoin to suspend customer logins and other platform services. Its investigation established that parts of its server infrastructure had been compromised.
On November 12, the exchange identified outgoing transactions involving an Ethereum address in its BitGo wallet infrastructure. Its initial investigation into the BitGo wallet transfers focused on whether an emergency recovery mechanism had allowed transactions to bypass the account restrictions.
Unocoin’s November 14 announcement established that three of its more than 20 operational wallets, used for activities including customer withdrawals, had been compromised. And three wallets, not one, were involved in the end.
The exchange said its encrypted backup keys had been generated approximately eight years earlier, printed on paper and placed in secure physical storage. Investigators have now established that the keys were compromised and subsequently used to authorize unauthorized transfers.
Unocoin also disclosed that a decryption passphrase associated with the printed encrypted backups existed within its compromised infrastructure. It has not established whether the attackers obtained the paper records, recovered usable key material from another location or exploited another weakness in the recovery process.
The paper copies were there, stored seperately, but somehow that was not enough. Unocoin said the presence of the passphrase within compromised infrastructure does not fully explain how the backup credentials were accessed and used.
BitGo identifies the keys behind unauthorized transfers
BitGo’s technical analysis provides transaction-level evidence explaining how assets could leave the affected wallets despite the enterprise account freeze.
The Ethereum wallet used a two-of-three multisignature arrangement. Unocoin controlled the user key and backup key, while BitGo controlled the third key. Any two valid signatures were sufficient to authorize a transaction.
Under the normal withdrawal process, Unocoin’s user key and BitGo’s key jointly authorize transfers. BitGo can apply its approval policies and security checks before providing its signature.
The recovery arrangement permits Unocoin to authorize transactions using its user and backup keys without BitGo’s participation. This preserves access to assets if BitGo becomes unavailable, but it also means that a party controlling both customer-held keys can independently satisfy the wallet’s signing requirements.
BitGo examined the Ethereum transactions and identified the backup key as the transaction sender, with the user key supplying the second signature through the wallet’s multisignature contract. The company matched the signing addresses against its wallet records and said Unocoin had confirmed their roles.
BitGo found no corresponding transaction initiation records on its own platform. It also reported that transaction-building requests submitted through its services on November 9 were blocked by the enterprise freeze.
The freeze worked, but the money moved anyway.
Freezing the enterprise account prevented BitGo from supplying its signature or processing transfers through its services. It did not invalidate the two keys Unocoin controlled or prevent transactions independently signed with those credentials from being accepted by the blockchain.
BitGo’s investigation also identified transfers involving ERC-20 tokens on Ethereum, XRP on the XRP Ledger, HBAR on Hedera and EOS. Its published detailed signature analysis focused on Ethereum, rather than providing an equivalent examination of every affected network.
The incident illustrates how custody arrangements with the same number of required signatures can distribute control differently. A separate multi-institution Bitcoin custody model examined by DaveFinances distributes signing authority among independent institutions, rather than allowing one customer to control enough keys to authorize a transaction alone.
BitGo also operates a distinct regulated custody business. The US Office of the Comptroller of the Currency records the conversion of BitGo Bank & Trust into a national trust bank as effective on December 12, 2025. That regulatory status should not be confused with Unocoin’s affected self-custody arrangement, in which BitGo did not control the two keys used in the unauthorized transfers.
On-chain investigation traces additional wallet activity
Blockchain analytics company Bitquery separately investigated the suspicious transactions and published findings updated through November 14.
Its investigation identified an Ethereum multisignature wallet associated with Unocoin that reportedly lost approximately $182,000 in ETH and other tokens between November 9 and November 11.
Bitquery identified 98 successful transfers involving 96 different assets. Its investigation found that the backup signing address had not previously been used to authorize withdrawals from the wallet, while the user key had participated in the wallet’s ordinary transactions.
According to the independant analysis, the first unauthorized transfer occurred six minutes and 24 seconds after Unocoin published a November 9 statement saying it had not identified cryptocurrency losses.
That sequence establishes the timing of the public statement relative to the blockchain activity. It does not establish whether the attackers were aware of the announcement or whether the timing was coincidental.
Bitquery also identified approximately 39,167 XRP, valued at roughly $42,700, leaving another wallet on the XRP Ledger. The investigation reported that a substantial portion of the traced Ethereum proceeds moved through cryptocurrency swap services.
These transaction-level figures are not a direct reconciliation of Unocoin’s approximately $200,000 corporate loss estimate. Bitquery valued tokens at their transaction-time prices and acknowledged limitations involving illiquid assets, unidentified wallets and subsequent movements.
That figure is not quite Unocoin’s estimate, and the public record does not yet make the two match. The exchange has not published a complete wallet-by-wallet accounting that would explain differences between its estimated financial loss and independently calculated transaction values.
Unocoin said the identified loss represented significantly less than 1% of the cryptocurrency assets it held on behalf of customers. It had previously stated that more than 90% of customer cryptocurrency holdings were maintained in cold storage.
The company has promised to replace the identified losses from its own resources, but has not provided a detailed schedule for completing the reconsiliation of affected balances or disclosed the amount of cryptocurrency that its partners have managed to freeze.
Potential customer data exposure adds to the investigation
Unocoin’s November 14 update also introduced a separate concern involving customer information potentially accessible through the compromised infrastructure.
The exchange said its investigation indicated that potentially exposed information included registered email addresses, residential addresses, encrypted account passwords, KYC-related information and cryptocurrency account balances.
Unocoin reported finding no evidence that customer KYC documents had been accessed. It has not yet confirmed whether the potentially exposed information was actually extracted by the attackers, and its investigation into possible unauthorized access remains ongoing.
The company warned customers about targeted phishing attempts that could use personal information to make fraudulent messages appear legitimate. It reiterated that customers should not disclose passwords, one-time passwords, private keys or wallet recovery phrases to anyone claiming to represent the exchange.
The operational response remains incomplete. Unocoin decided to rebuild its server infrastructure rather than restore the compromised environment, with security testing and validation required before services resume.
Customers still have the service outage to deal with, and now the data question too.
The incident also presents a different authorization failure from the one described in Bitget’s $387.5 million wallet security breach in September. Bitget attributed that attack to manipulated backend transaction data and said its private keys had not been stolen. Unocoin has confirmed that its backup credentials were compromised, although the original access method remains unresolved.
BitGo has advised Unocoin to transfer remaining assets into newly generated wallets with fresh signing keys. The recommendation addresses the continuing ability of compromised credentials to authorize transfers independently of platform-level restrictions.
Unocoin has not announced a confirmed reopening date. Its outstanding investigation must establish how the backup keys were compromised, determine the final financial impact and assess the extent of any customer information exposure. The company has committed to funding the identified cryptocurrency losses, while its ability to restore operations will depend on completing the infrastructure rebuild and security checks.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.