Unocoin Says BitGo Freeze Appears Effective After Wallet Incident

By Nathan Brooks

A Nov. 6 instruction to BitGo and Fireblocks to freeze Unocoin’s corporate accounts appears to have contained suspicious wallet activity, the company said Friday, although it has not disclosed a confirmed loss and continues to investigate a suspected exploit involving a multisignature wallet backup.

Unocoin said: “BitGo’s freeze of its corporate account appeared to be working as intended.” The request came after Unocoin detected suspicious, unauthorized activity and asked both companies to freeze its corporate accounts. The freeze therefore functions as an incident-response control, not as a conclusion that the investigation has ended.

At the time of the Nov. 6 instruction, Unocoin had not identified any crypto-asset losses. That was a point-in-time finding rather than a final zero-loss conclusion. The company is now checking whether the mechanism enabled asset movement, how much was lost if anything, and whether information privacy was affected.

BitGo has since supplied the information and explanations Unocoin requested. According to Unocoin, the relevant transfers were signed and broadcast directly on-chain, outside BitGo’s platform and without BitGo’s involvement. That separation matters for scope: the transactions did not execute as ordinary activity processed by the platform, but the suspected weakness still sits in a wallet structure operated with BitGo.

The suspected weakness involves a backup mechanism designed to permit withdrawals if BitGo becomes unavailable. Unocoin is investigating whether that emergency route was used, whether crypto assets moved through it, and whether any information was exposed. Because the company has not published a loss amount, the incident cannot yet be sized in monetary terms.

On Nov. 12, Unocoin flagged outbound transfers from an Ether (ETH) address in its BitGo wallet. The company said that address had been used to fund ERC-20 tokens. The disclosure gave the review a defined set of outbound movements to examine.

Unocoin could not fully reconstruct those transactions when it disclosed the problem. The account freeze and the wallet’s use of change addresses prevented a full reconstruction at that time. BitGo’s subsequent explanations and information have not yet allowed Unocoin to publish a complete accounting.

The limitations explain why Unocoin is separating containment from resolution. The freeze restricts additional activity through the account, while reconstruction still requires tying the outbound transfers to the backup process and assessing what information, if any, was exposed.

What does the freeze change for Unocoin?

The immediate change is containment at the corporate-account level. BitGo’s action appears to have contained the affected account while Unocoin investigates. The freeze does not supply a loss figure or settle whether the backup mechanism was abused, and it does not resolve the privacy question.

For Unocoin’s operations, the trade-off is straightforward: freezing the corporate account constrains further transfers through that account, while restoration waits on a review covering asset movement and information exposure. The freeze reduces immediate activity but delays operational normalization until the investigation reaches a conclusion.

This leaves Unocoin to document the outbound transfers, establish how the backup mechanism was used and restore service without extending the incident. No completion deadline has been announced, and Unocoin has not published a quantified loss.

Three points remain unresolved:

• Whether and how BitGo’s multisignature wallet backup mechanism was used.
• Whether any crypto assets were lost, and if so, in what amount.
• Whether information privacy was affected.

BitGo’s provision of information and explanations gives Unocoin material for the next phase of its review, even though the relevant transfers occurred outside BitGo’s platform. The central control under review is the backup mechanism that permits withdrawals when BitGo is unavailable. Its purpose is continuity during BitGo unavailability, and that purpose now requires validation against unauthorized use.

Unocoin plans to restore service after its investigation is complete. With no public deadline or quantified loss disclosed, that completion is the next milestone; the freeze remains the operative control until then.