BitGo says it was not the weak link in the security incident affecting Unocoin, one of India's longest-running cryptocurrency exchanges. According to the custody provider, the exchange signed a set of Ethereum transactions using its own user and backup keys, while BitGo's key was never used.

That clarification shifts the focus of the investigation away from the custodian and back toward the exchange itself. Unocoin has suspended all services, including user logins, while it works to determine what went wrong. The custody provider's findings were detailed in a report by Crypto Briefing.

A Week of Freezes, Shutdowns and Flagged Transfers

The trouble began on November 6, 2026, when Unocoin detected unauthorized activity on its platform and moved quickly to lock things down.

The exchange asked Fireblocks, an enterprise digital asset infrastructure provider, to freeze its enterprise accounts at 11:24 UTC. Five minutes later, at 11:29 UTC, it sent the same request to BitGo. Both freezes were confirmed shortly after the requests came in.

The freezes did not end the episode. On November 9, further unauthorized actions pushed Unocoin to shut down every service on the platform, logins included. The exchange began investigating a potential compromise of its servers and said it planned to rebuild its systems from scratch, a job it estimated would take 4-5 working days.

Another twist followed on November 12, when Unocoin spotted outgoing Ethereum transactions from its BitGo wallet infrastructure and escalated those transfers for review.

How a 2-of-3 Wallet Works — and Why BitGo Is Pointing at the Keys

To understand BitGo's response, it helps to know how the wallet was set up. Unocoin used a 2-of-3 multisig arrangement in which the three keys are a user key, a backup key and BitGo's key. Any two signatures are enough to approve a transaction.

Setups like this are common in institutional custody precisely because they spread signing authority across separate holders, so no single party can move funds on its own.

That is the crux of BitGo's finding. Its investigation, completed on November 13, concluded that its systems had not been breached. The Ethereum transactions, BitGo said, were authorized using Unocoin's own private keys — the user key and the backup key — with BitGo's key never involved.

The findings point to a possible exploitation of the backup key mechanism within Unocoin's multisig setup, according to BitGo. That remains a working theory rather than a confirmed explanation, and the investigation is still underway. BitGo also said no other clients were affected by the incident.

Where Unocoin's Customers Stand

Unocoin's position is that the damage is contained. The exchange says it keeps over 90% of customer assets in cold storage — offline wallets that are not connected to the internet — and that there have been no confirmed losses so far. Keeping the bulk of funds offline is a common practice among exchanges: the smaller online balance, held in hot wallets, is what covers day-to-day withdrawals, and it is that connected portion that is most exposed when infrastructure comes under attack.

That claim sits alongside a less comforting admission: Unocoin says it does not yet have full visibility into every transaction. The exchange attributes the gap to the complexity of change addresses, which receive leftover funds from a transaction and can make tracing the full path of money more complicated than following a single transfer.

Meanwhile, customers cannot log in at all until the rebuild is finished. The near-term markers to watch are whether the rebuilt systems come back online within the estimated 4-5 working days and whether Unocoin's transaction accounting is eventually completed.

What This Means for Exchanges and Custody Providers

Third-party multisig custody is built on the idea that the custodian's key acts as an independent check that the client cannot exercise on its own. If two of the three keys sit under the same organization's control, the safeguard depends heavily on how carefully that organization protects them. A compromised server holding or accessing both keys could, in theory, approve transactions without the custodian's involvement. The investigation will determine whether that is what happened here.

The bigger question for traders is how exchanges design the backup key piece of their custody arrangements. If the investigation confirms that the mechanism was exploited, other platforms running similar 2-of-3 setups may revisit where their backup keys live and who can reach them.

If Unocoin's claim of keeping over 90% of customer assets in cold storage holds up, the bulk of user funds sat outside the hot infrastructure that appears to have been targeted.

Until Unocoin can account for every outgoing transaction, including those routed through change addresses, “no confirmed losses” remains a statement about what has been verified so far, not a final tally.