BitGo says two client-held keys authorized Unocoin transfers

By Nathan Brooks

In a Nov. 13 statement on X, BitGo said its review found that two client-held keys authorized outgoing Unocoin transfers after the exchange’s account was frozen on Nov. 6, denying any compromise of its systems.

Unocoin, an Indian exchange, controls the user key and backup key in a 2-of-3 self-custody arrangement. BitGo holds the third key and says it never used that key in the disputed transfers. In its Nov. 13 statement, BitGo said the transactions were “signed with Unocoin’s user and backup keys and broadcast directly on-chain without its participation.”

BitGo said no other clients were affected and directed questions about customer funds to Unocoin. Its conclusion identifies the signing path, not the person who used the keys or the size of any loss.

How did the transactions proceed without BitGo?

BitGo’s wallet documentation describes the normal transaction path: the user key plus BitGo’s key. The backup key can replace either one, so combining the backup key with the user key can authorize an outgoing transfer.

The architecture leaves key possession with the client. For self-custody wallets, clients create their user and backup keys on their own side, then provide BitGo an encrypted user key and a public backup key. BitGo says it cannot access the private user or backup keys.

Its recovery guide extends that separation. Users can assemble a fully signed transaction without BitGo services and broadcast it through a blockchain explorer; the guide covers Ethereum and ERC-20 token recoveries.

The recovery inputs include:

• The encrypted user key, backup key, wallet passphrase and destination address.
• The Ethereum wallet contract address.
• A separate token contract address for ERC-20 assets.

What did Unocoin investigate after the freeze?

Unocoin disclosed outgoing transactions on Nov. 12 from an Ethereum address within its BitGo wallet infrastructure, days after requesting freezes on accounts used for daily cryptocurrency transactions. Frozen account access prevented the exchange from reviewing the complete transaction history through BitGo.

The exchange requested transaction-level information after identifying transfers from an ETH address used to fund ERC-20 tokens. In its Nov. 13 incident update, Unocoin said it had received the information and clarifications requested from BitGo.

Unocoin acknowledged that the freeze appeared to have worked and that the transactions were signed and broadcast outside the provider’s platform. The exchange suspects the wallet’s backup mechanism was exploited and is investigating how it was accessed, any cryptocurrency loss and possible exposure of private information.

Neither BitGo’s statement nor Unocoin’s Nov. 13 clarification names the person who used the keys.

What did the server compromise change?

Earlier disclosures traced a wider service compromise. Unocoin disabled customer logins after disclosing unauthorized server access on Nov. 9, and its website returned a 504 Gateway Time-out error on Nov. 12. Crypto.news previously reported that Onchain Lens, citing Arkham Intelligence, showed zero holdings across roughly 81,000 addresses associated with the exchange.

Unocoin maintained “no customer funds were lost” when it first announced the login suspension. Neither the BitGo statement nor the Nov. 13 Unocoin clarification supplies a confirmed loss figure.

The exchange said it detected suspicious activity on Nov. 6. It requested a Fireblocks account freeze at 11:24 UTC and a BitGo freeze at 11:29 UTC, and both providers confirmed the requests. After further unauthorized activity on Nov. 9, Unocoin suspended all services.

Unocoin’s investigation established that its infrastructure had been compromised, according to the exchange. The systems accessed and the information potentially exposed remained under review.

What does this change for exchange operators?

The provider freeze held, while the backup path allowed a client-held signature to reach Ethereum independently. That distinction matters because a platform freeze cannot prevent an independently signed transaction once the client possesses the required keys.

For exchange operators, the practical question is what changes now. Provider account freezes address one route into the wallet infrastructure; they do not, by themselves, resolve client-side key security. Unocoin’s disclosures place the backup mechanism and compromised servers inside the same incident perimeter, alongside the exchange’s effort to restore customer access.

Unocoin said more than 90% of customer cryptocurrency was held in cold storage. It estimated four to five working days to rebuild and secure its server infrastructure, with security checks and validation required before services resumed.

The next operational checkpoint is that four-to-five-working-day rebuild, but Unocoin has not published a confirmed loss figure or identified the person who used the keys.