Unocoin Says BitGo Freeze Held but a Backup Key Let Funds Leave

Unocoin says funds left a BitGo-confirmed frozen wallet through a backup recovery path that "appears to have been exploited," according to a November 13 statement from the Indian exchange. On-chain records the company says it traced support the claim, though the exchange has not named who controlled the key or stated the amount lost.

Unocoin suspended all services on November 9. It then traced outgoing transactions from an Ethereum address inside its BitGo wallets, and by November 12 it determined that address had been used to fund ERC-20 tokens. The company says BitGo's change-address setup makes a full reconstruction of the transaction history difficult. In plain words: the exchange can see money left, but not cleanly how.

What does BitGo's own documentation say?

BitGo's documents shift responsibility toward its clients. Its Wallet Recovery Wizard lets clients extract assets from their wallets "without BitGo," using the user key and the backup key to move funds to a new address. The documents state that these recovery transactions "bypass any policies you have with BitGo."

The recovery wizard requires four inputs: the backup public key, the user public key, the wallet passphrase, and either the BitGo public key or the wallet address. That design is intentional. It exists so a client can reach funds even if BitGo goes offline — a failsafe that, if Unocoin's account is correct, doubled as an escape hatch around the freeze.

The caveat matters here: Unocoin has not identified the holder of the relevant key, and it has not quantified the loss. Absent that, the word "exploited" is an allegation about a mechanism, not a finding about an actor.

How much is actually at stake?

Unocoin has confirmed that more than 90% of customer crypto sits in cold storage. On November 12, roughly 80,986 Unocoin-linked addresses on Arkham Intelligence showed a combined value of zero. That figure needs context: the same report showed those labeled wallets held at most hundreds of dollars over the past month, with a three-month peak of just over $250,000 — roughly the price of a modest apartment, not an exchange-scale treasury.

Operationally, Unocoin is rebuilding its entire server stack, which it expects to take four to five working days. Until that completes, customers face continued service suspension; the exchange has offered no timeline beyond the rebuild.

Is there a precedent for this dispute?

The pattern is not new. After the $234 million WazirX hack in July 2024, the Indian exchange and its custody partner Liminal spent months assigning blame to each other. Liminal claimed all transactions originated from the client's end; WazirX argued the loss stemmed from a fault in the Liminal platform. That dispute remains unresolved, and the Unocoin-BitGo conflict now follows the same structure: a custodian and a client, each with documentation that points away from itself.

The difference is scale. The WazirX loss ran to nine figures; Unocoin's visible on-chain exposure, per Arkham labels, peaked near a quarter of a million dollars over three months. The reputational exposure for BitGo may exceed the financial one.

Where does BitGo stand financially?

Separately, BitGo reported third-quarter net income of $44.1 million, driven by a rise in the value of its digital asset treasury, with unrealized gains of $71.5 million. Those gains remain unrealized — paper appreciation, not banked profit — and a single quarter's treasury revaluation says little about custody operations.

In short, BitGo enters this dispute from a position of reported strength.

Unocoin's four-to-five-day server rebuild is the nearest checkpoint: expect the exchange to publish a fuller transaction reconstruction, and possibly a named counterparty, once the new stack is live.