# Unocoin Halts All Services After Transfers Signed With Its Own Keys Went Around a BitGo Freeze

BitGo says its key was never used, so its freeze on Unocoin's account could not stop transfers signed with the two keys Unocoin held in a two-of-three multisignature wallet.

- Published: 2026-11-14T05:48:35.118Z
- Canonical: https://polylog.news/crypto/2026-11-14/unocoin-halts-all-services-after-transfers-signed-with-its-o
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/unocoin-halts-all-services-after-hackers-bypass-bitgo-freeze/), [Rekt News](https://www.rekt.news/)

Unocoin, one of India's oldest bitcoin exchanges, has shut down every service, including customer logins, while it investigates outgoing transfers from wallets it ran on BitGo's custody platform. Unocoin's position, [as CryptoSlate reports it](https://cryptoslate.com/unocoin-halts-all-services-after-hackers-bypass-bitgo-freeze/), is that someone signed and broadcast the disputed transfers outside BitGo while BitGo's freeze on its enterprise account stayed in force. Unocoin says it suspects misuse of a backup mechanism.

The timeline comes from the companies' own statements. Unocoin [detected unauthorized activity on November 6](https://www.kucoin.com/news/flash/unocoin-halts-services-after-hackers-bypass-bitgo-freeze), the same day BitGo froze the enterprise account. More unauthorized actions on November 9 led Unocoin to suspend all services. On November 12 it flagged outgoing Ethereum transactions from its BitGo wallets. Reports disagree on whether the full halt began on November 9 or later.

The attack exploited a feature of the wallet's design. BitGo wallets use three keys: one held by the customer, a backup key, and one held by BitGo. Any two can sign. Normal transactions pair the customer key with BitGo's key, and the backup key exists for recovery. BitGo says the transactions [were authorized with Unocoin's user and backup keys](https://cryptonews.net/news/security/33749553/) and that "BitGo's key was never used." Those two keys can move funds without BitGo, so a freeze that works through BitGo's co-signing never reached them. The root cause is therefore a compromise of key material in Unocoin's hands, or of the systems that held it. BitGo's signing logic was not the failure point. Unocoin says it has not yet established how the account was accessed or who authorized the transfers.

Unocoin has not confirmed a loss figure, and no one has claimed recovery or attribution. The exchange says it keeps [more than 90% of customer assets in cold storage](https://cryptobriefing.com/bitgo-unocoin-security-incident-keys/) and plans to rebuild its systems entirely, which it estimated would take [four to five working days](https://www.spendnode.io/blog/unocoin-stays-offline-as-backup-key-transfers-bypass-bitgo-freeze/).

Each company's account of the breach protects that company. BitGo's statement places the failure in the customer's key custody. Unocoin's wording, "misuse of a backup mechanism," points at the custody arrangement itself. Both statements can be true together. Unocoin is the second large exchange breach this month. Mercado Bitcoin, Brazil's largest exchange, [said attackers took about $38 million from hot wallets on November 2](https://theblock.co/news/defi/2026-11-02-mercado-bitcoin-hack-46-million-brazil-exchange-432333), an incident [Rekt News](https://www.rekt.news/) has written up. India has a recent precedent as well: WazirX lost about $230 million in July 2024 from a multisignature wallet it operated with an outside custody provider.

## What this means

The mechanism is key distribution. When a platform holds two of the three keys, the custodian only co-signs and cannot block anything, so a custodian "freeze" protects only against misuse of the custodian's own key. Indian retail customers carry the immediate exposure. So does every exchange that markets a BitGo-style setup as institutional custody, and BitGo's sales pitch that account freezes work as a control. The market prices "held with a qualified custodian" as protection, but the protection depends on who holds which keys and how the backup key is stored, and outsiders rarely know either. WazirX is the closest precedent: withdrawals stayed frozen and users waited through a court-supervised restructuring in Singapore for more than a year. The desk's read is that Unocoin will reopen within weeks with withdrawal limits and a confirmed loss well below its total assets, if the cold-storage claim holds on-chain. Over the following months, custodians are likely to move backup keys to independent holders or put them behind time delays. That read is wrong if on-chain tracing shows Unocoin's cold wallets moving, or if evidence emerges that BitGo's key or infrastructure took part.

## What to watch

- Whether Unocoin publishes a confirmed loss figure and explains how its user and backup keys were reached. A clear answer decides whether this was an insider, malware or a custody-design failure.
- Movement of the Ethereum transfers Unocoin flagged on November 12. Routing through mixers or cross-chain bridges would suggest a professional theft group and not an internal dispute.
- Whether BitGo or other custodians change how backup keys are held for exchange clients. A policy change would amount to an admission that the current arrangement leaves a gap.