Unocoin halts all services after hackers bypass BitGo wallet freeze

Indian crypto exchange Unocoin halted all services after attackers moved funds from an Ethereum address inside its BitGo wallet infrastructure, using a signing path that sits outside the provider's freeze controls. Unocoin reported the outgoing transactions on Nov. 12 and attributed the disputed activity to external signing in a Nov. 13 explanation.

The suspected misuse of backup key access remains under investigation. The episode turns on a structural feature of BitGo's multi-signature architecture, not a broken freeze. Here is how that works.

How did the attackers get around the freeze?

BitGo's wallet documentation describes three keys: the user key, the backup key, and the BitGo key. Normal transactions need two of the three. Day to day, the user key and the BitGo key sign together.

The backup key can pair with either of the other two. That is the critical detail. A transaction signed by the user key and the backup key still satisfies the two-of-three requirement, but it leaves BitGo entirely outside the signing process.

BitGo states this limit plainly in its withdrawal-policy documentation. Those policies apply only to transactions involving BitGo. Recovery transactions signed with the user and backup keys bypass the policies configured with the provider.

That capability exists for good reason. It preserves access when the provider is unavailable. But it also means an account freeze cannot function as a blanket restriction on every transaction the wallet's keys can sign. In Unocoin's case, someone appears to have used that recovery route to move funds despite the freeze.

What does this change for customer funds?

Unocoin said in its Nov. 12 report that more than 90% of customer cryptocurrency funds were held in cold storage. That figure offers some comfort. It does not settle the loss assessment.

The exchange was still establishing the complete status of its holdings and its potential exposure when it published that statement. No final loss figure has been released.

The affected address was used to fund ERC-20 token operations on Ethereum, according to Unocoin's report. The Nov. 13 explanation attributes the activity to external signing, without naming the actor or the mechanism with certainty.

What happens next?

Unocoin's latest update says work to restore services is continuing. All services remain halted in the meantime.

Three questions remain open:

• How the suspected recovery path was accessed — whether through a compromised backup key, a leaked user key, or an insider route
• What losses or information exposure resulted from the transactions
• When Unocoin can resume operations for its customer base

The broader lesson for custodial operations is operational, not theoretical. Any exchange relying on BitGo-style multi-signature wallets must treat withdrawal policies as provider-scoped controls, not absolute locks, because the backup-key recovery path can satisfy the signing threshold while excluding the custodian entirely — a market-structure reality that institutional treasurers will now have to price into their custody arrangements while Unocoin's investigation runs.