BitGo says freeze held as Unocoin probes off-platform transfers

By Tom Whitfield

Unocoin detected suspicious activity on Nov. 6 and requested freezes of its enterprise accounts at BitGo and Fireblocks; it later found outgoing Ethereum transfers signed outside BitGo’s platform.

No confirmed loss figure has been published. BitGo denied a breach of its platform and said its Nov. 6 freeze “functioned as intended.” Unocoin’s Nov. 13 incident update said the transactions had been signed and broadcast outside BitGo.

A backup mechanism designed to preserve access if BitGo became unavailable appeared to have been exploited. The exchange said it was investigating the mechanism, cryptocurrency losses and information privacy.

What did the Nov. 6 freezes cover?

Unocoin said it requested freezes on its enterprise accounts at BitGo and Fireblocks. Those accounts held balances used for day-to-day transactions. Both providers confirmed that no further transactions could be initiated through their platforms.

That control did not determine whether a recovery arrangement could operate independently.

When did Unocoin find the transfers?

Unocoin said it discovered the outgoing transfers from an Ethereum address in its BitGo wallet infrastructure on Nov. 12. Neither company specified when the transfers executed, so the discovery date should not be treated as the transaction date.

The freeze prevented new transactions through the platforms but did not stop every possible signing path. Freezing a provider’s platform resembles disabling a company login while leaving separately issued credentials usable; it does not establish that the provider participated.

How could recovery keys operate outside BitGo?

BitGo’s wallet documentation says normal transactions use the user key and the BitGo key. The backup key can instead pair with either key, and recovery instructions describe signing and broadcasting transactions without using BitGo services.

In that setup, freezing BitGo’s platform does not remove the client’s separate ability to sign with its two keys.

Unocoin’s Nov. 13 acknowledgment is consistent with that architecture. Its incident update said the transactions were signed and broadcast outside BitGo’s platform, and the backup mechanism appeared exploited. The exchange said it was investigating the mechanism, cryptocurrency losses and information privacy.

The disclosures do not identify who used the keys or assign responsibility for losses. They also do not establish whether the Nov. 9 server intrusion directly enabled the transfers; Unocoin has not published that forensic link.

Why is Unocoin’s loss figure unresolved?

On Nov. 9, Unocoin disclosed unauthorized server access, disabled customer logins and said no cryptocurrency had been lost. A subsequent notice said the exchange suspended all services after detecting further unauthorized activity that day and established that its infrastructure had been compromised.

On Nov. 13, Unocoin continued to tell users: “No user funds have been lost, and your assets remain safe.” Its incident notice nevertheless said investigators were still determining cryptocurrency losses and the status of its holdings. The exchange also said more than 90% of customer cryptocurrency was held in cold storage.

The two statements leave the loss amount unresolved. Neither supplies a reconciled loss total.

What does Arkham’s snapshot show?

A Nov. 12 Arkham snapshot of Unocoin’s entity page listed 80,986 attributed addresses and no priced token holdings. The snapshot alone does not establish a theft, identify when balances changed or capture assets held outside that address set.

The address total also does not equal the number of affected customers. Treating 80,986 addresses as 80,986 victims would overstate the incident’s verified reach.

When can customers withdraw again?

Unocoin’s website showed a maintenance notice on Nov. 13. The exchange estimated that rebuilding its server infrastructure would take four to five working days, followed by security checks before services resumed.

It said withdrawals and pending requests would proceed after restoration, but gave no fixed reopening date. The next verifiable checkpoint is completion of the security review and restoration of withdrawals; the four-to-five-day estimate remains a planning range rather than a firm deadline.