Unocoin keeps withdrawals frozen amid BitGo wallet recovery probe

Indian cryptocurrency exchange Unocoin has kept all deposits and withdrawals suspended as it investigates unauthorized transfers executed from wallets held in custodian BitGo's enterprise infrastructure, with the exchange suspecting misuse of a wallet recovery feature.

The episode compresses into a tight timeline. On Nov. 6, Unocoin detected unauthorized activity and requested that BitGo freeze its enterprise account. The freeze, the exchange said on Friday, worked exactly as intended. Yet outgoing transactions continued — signed and broadcast outside BitGo's platform entirely. By Monday, Unocoin had suspended all services after detecting further activity. On Thursday, it disclosed outgoing transactions from an Ethereum address within its BitGo wallet infrastructure and stated that its own servers had been compromised.

How were funds moved from a frozen account?

That question sits at the center of the investigation. According to Unocoin, BitGo's multisignature wallets include a recovery mechanism designed to let wallet holders access their funds if BitGo itself becomes unavailable — a standard self-custody escape hatch in institutional custody architecture. Unocoin suspects this feature was misused to move funds while the enterprise account itself was locked.

The exchange has not established how the transfers occurred, nor whether any digital assets were actually lost. That gap matters. A frozen custody account with outgoing on-chain movement points to a control failure at the key-management layer, not merely at the platform-permission layer, and it complicates any eventual attribution between the server compromise and the wallet-side transfers.

Neither Unocoin nor BitGo responded to a request for further information before publication, leaving the recovery-feature hypothesis unconfirmed by the custodian. For a custody provider, that silence is itself notable: the integrity of multisig recovery paths is a core selling point for institutional clients.

What does this change for exchanges using institutional custody?

For operators, the incident raises a practical question about recovery features that the industry has largely treated as a safety net rather than an attack surface. If a holder-side recovery mechanism can be invoked while an account is frozen, then the freeze — an operational control exchanges rely on during incidents — no longer constitutes a full stop on fund movement. Exchanges running BitGo enterprise wallets, or comparable multiparty custody setups, may need to reassess who holds the recovery credentials, where they are stored, and whether server-side compromise can cascade into recovery-key access.

The sequence also illustrates the speed compression of modern incident response. Detection on Nov. 6, a full service suspension within days, and public disclosure of an Ethereum-address outflow by Thursday — a window measured in hours, not weeks.

Is there a connection to the wider cyber campaign?

Possibly, but nothing is established. On Nov. 5, a day before Unocoin's first detection, India's cybersecurity agency issued a warning describing an AI-assisted campaign targeting cryptocurrency exchanges and other financial firms. No link between that campaign and the Unocoin incident has been confirmed, and the exchange has not attributed the compromise to any actor.

Unocoin has not announced a date for restoring deposits and withdrawals. The reopening now depends on the outcome of two intertwined investigations — the server breach and the recovery-path transfers — and until both are resolved, the exchange's operational footprint remains effectively reduced to a static platform with frozen rails.