BitGo Denies Breach as Unocoin Probes Unauthorized Wallet Transfers

BitGo says its systems were not breached in the security incident affecting Indian cryptocurrency exchange Unocoin, whose services remain suspended. The custodian stated that the disputed outgoing transfers were signed with two keys held by Unocoin itself, not by BitGo.

In a Nov. 13 statement, BitGo explained that Unocoin operated a self-custody wallet arrangement requiring two of three signing keys. Unocoin held the user key and the backup key, while BitGo held the third. According to BitGo's review, the transfers in question were signed with the two Unocoin-held keys and broadcast directly onchain, without BitGo's participation.

"BitGo's key was never used," the company said. It added that no other clients were affected and directed questions about customer funds to Unocoin.

Because none of the disputed transfers required BitGo's key, the case highlights how shared-key custody splits responsibility between an exchange and its infrastructure provider — and why the exchange's own operational security is now the central open question.

Backup Mechanism Under Scrutiny

Unocoin, in its own Nov. 13 incident update, acknowledged that the transactions were signed and broadcast outside BitGo's platform. The exchange said a backup mechanism designed to preserve access to funds if BitGo became unavailable appeared to have been exploited. It is investigating the mechanism, along with potential cryptocurrency losses and information privacy concerns.

Fallback signing paths like this are a standard feature of shared-key custody designs, giving clients an independent route to their assets if a provider becomes unavailable.

What the Nov. 6 Freeze Covered

Unocoin said it first detected suspicious activity on Nov. 6 and requested freezes of its enterprise accounts at BitGo and Fireblocks, which held balances used for day-to-day transactions. According to the exchange, both providers confirmed that no further transactions could be initiated through their platforms. BitGo said its Nov. 6 freeze "functioned as intended."

The exchange said it discovered outgoing transactions from an Ethereum address within its BitGo wallet infrastructure on Nov. 12. That was the discovery date; neither company's statement specified when the transfers were executed.

BitGo's wallet documentation states that normal transactions use the user key and the BitGo key, but the backup key can be paired with either of the other two. Its recovery instructions describe signing and broadcasting transactions without using BitGo services. Under that setup, freezing access to BitGo's platform does not remove the client's separate ability to sign with its own two keys. That distinction explains how transfers can occur without BitGo's participation, though it does not establish who used the keys or who bears responsibility for any loss.

Customer Funds Remain Under Review

Unocoin disclosed unauthorized server access on Nov. 9, disabled customer logins, and said at the time that no crypto funds had been lost. Its subsequent incident notice said it suspended all services after detecting further unauthorized activity that day and established that its infrastructure had been compromised.

The exchange continued to tell users on Nov. 13 that "No user funds have been lost, and your assets remain safe." Its incident notice, however, said it was still investigating cryptocurrency losses and establishing the status of its holdings. Unocoin said more than 90% of customer cryptocurrency was held in cold storage, which keeps signing keys offline and away from internet-connected systems. The notice gave no confirmed loss figure.

A Nov. 12 snapshot of the Unocoin entity page on Arkham, an onchain analytics platform, listed 80,986 attributed addresses with "no priced token holdings." That snapshot alone does not establish a theft, when balances changed, or whether Unocoin holds assets outside that address set. The address count is also not a count of affected customers.

On Nov. 13, Unocoin's website displayed a maintenance notice. The exchange estimated that rebuilding its server infrastructure would take four to five working days, with security checks required before services resumed. It said withdrawals would resume and pending requests would be processed once services were restored, without giving a fixed reopening date. Until then, the disclosures leave clear markers to watch: a confirmed loss figure, the timing and attribution of the disputed transfers, and a firm date for services coming back online.