Unocoin Halts All Services After Transfers Signed With Its Own Keys Went Around a BitGo Freeze

Unocoin, one of India's oldest bitcoin exchanges, has shut down every service, including customer logins, while it investigates outgoing transfers from wallets it ran on BitGo's custody platform. Unocoin's position, as CryptoSlate reports it, is that someone signed and broadcast the disputed transfers outside BitGo while BitGo's freeze on its enterprise account stayed in force. Unocoin says it suspects misuse of a backup mechanism.

The timeline comes from the companies' own statements. Unocoin detected unauthorized activity on November 6, the same day BitGo froze the enterprise account. More unauthorized actions on November 9 led Unocoin to suspend all services. On November 12 it flagged outgoing Ethereum transactions from its BitGo wallets. Reports disagree on whether the full halt began on November 9 or later.

The attack exploited a feature of the wallet's design. BitGo wallets use three keys: one held by the customer, a backup key, and one held by BitGo. Any two can sign. Normal transactions pair the customer key with BitGo's key, and the backup key exists for recovery. BitGo says the transactions were authorized with Unocoin's user and backup keys and that "BitGo's key was never used." Those two keys can move funds without BitGo, so a freeze that works through BitGo's co-signing never reached them. The root cause is therefore a compromise of key material in Unocoin's hands, or of the systems that held it. BitGo's signing logic was not the failure point. Unocoin says it has not yet established how the account was accessed or who authorized the transfers.

Unocoin has not confirmed a loss figure, and no one has claimed recovery or attribution. The exchange says it keeps more than 90% of customer assets in cold storage and plans to rebuild its systems entirely, which it estimated would take four to five working days.

Each company's account of the breach protects that company. BitGo's statement places the failure in the customer's key custody. Unocoin's wording, "misuse of a backup mechanism," points at the custody arrangement itself. Both statements can be true together. Unocoin is the second large exchange breach this month. Mercado Bitcoin, Brazil's largest exchange, said attackers took about $38 million from hot wallets on November 2, an incident Rekt News has written up. India has a recent precedent as well: WazirX lost about $230 million in July 2024 from a multisignature wallet it operated with an outside custody provider.