Unocoin Freezes Custody Accounts, Claims 90% of Assets in Cold Storage

Indian cryptocurrency exchange Unocoin says it holds over 90% of customer assets in cold storage after a suspected server compromise forced it to shut down all platform services, including customer logins, on November 9.

The sequence of custodial lockdowns is documented by timestamps. Unocin asked Fireblocks to freeze its enterprise accounts at 11:24 UTC on the day of the incident. Five minutes later, at 11:29 UTC, it sent the same request to BitGo. Both custodians confirmed the freezes shortly after the requests arrived.

The freezes did not contain the episode. On November 9, further unauthorized actions pushed Unocoin to halt every service on the platform. The exchange opened an investigation into a potential compromise of its servers and said it would rebuild its systems from scratch — a job it estimated at four to five working days. Customers remain unable to log in until that rebuild finishes.

What did BitGo's investigation find?

The technical arrangement matters. Unocoin ran a 2-of-3 multisig wallet: a user key, a backup key and BitGo's key, with any two signatures sufficient to approve a transaction.

BitGo completed its investigation on November 13 and concluded its own systems had not been breached. The November 12 Ethereum transactions leaving Unocoin's BitGo wallet infrastructure were authorized with Unocoin's own private keys — the user key and the backup key — without BitGo's key involved at any point. Unocoin escalated those transfers for review after spotting them.

The findings point toward a possible exploitation of the backup key mechanism within Unocoin's multisig setup. That remains a working theory rather than a confirmed explanation, and the investigation is still underway. BitGo said no other clients were affected by the incident.

Where do Unocoin's customers stand?

Unocin's position is that the damage is contained. The exchange reports no confirmed losses so far and maintains that the bulk of user funds sat offline in cold wallets, outside the hot infrastructure that appears to have been targeted.

That claim sits alongside a less comforting admission. Unocoin says it does not yet have full visibility into every transaction. The exchange attributes the gap to the complexity of change addresses — addresses that receive leftover funds from a transaction and can obscure the full path of money beyond a single transfer.

Until Unocoin accounts for every outgoing transaction, including those routed through change addresses, "no confirmed losses" describes what has been verified so far, not a final tally.

What does this mean for 2-of-3 custody designs?

The operational lesson is structural. If two of three keys sit under the same organization's control, the safeguard depends on how carefully that organization protects them. A compromised server holding or accessing both keys could, in theory, approve transactions without the custodian's involvement. The ongoing investigation will determine whether that is what happened here.

For other platforms, the question is where backup keys live and who can reach them. If the investigation confirms the backup key mechanism was exploited, exchanges running similar 2-of-3 setups may revisit their own arrangements.

For now, Unocoin's customers face a concrete timeline: logins stay closed until the four-to-five-day system rebuild completes, and a full accounting of the November 12 Ethereum transfers remains the exchange's outstanding obligation.