Indian cryptocurrency exchange Unocoin suspects that the backup mechanism of its BitGo multisignature wallet was exploited, after outgoing transactions occurred despite an enterprise account freeze that took effect on November 6. In a November 13 update, the exchange said the disputed transactions were signed and broadcast outside BitGo's platform.

BitGo Freeze Worked as Intended, Unocoin Says

Unocoin identified questionable Ethereum wallet activity on November 12 and subsequently received clarifications from BitGo. According to Unocoin, BitGo confirmed that its enterprise account freeze took effect on November 6. The transactions, however, were signed externally and broadcast directly on-chain without BitGo's platform or involvement.

Unocoin suspects an emergency wallet recovery mechanism was used to access the funds. The exchange has not established how the mechanism was accessed or who authorized the transfers. Account restrictions and blockchain transaction signing depend on different controls, meaning a freeze at one layer does not necessarily block activity at the other.

Backup Signing Mechanism Under Investigation

BitGo's wallet documentation describes a two-of-three signing system that uses user, backup, and BitGo keys. Normal transactions rely on the user and BitGo keys, while the backup key supports recovery. The documentation states that two available keys can complete a transaction without the standard signing combination. That design is why the signing keys, rather than the platform-level freeze, sit at the center of the inquiry: under the documented scheme, any two of the three keys can move funds directly on-chain.

Unocoin has not identified which keys signed the disputed transactions or how access occurred. Its statement does not establish a breach of BitGo's platform or a failure of the freeze. No transaction hashes, destination addresses, or verified loss amounts have been disclosed.

On November 12, Unocoin reported outgoing transfers from an Ethereum address used to fund ERC-20 token operations. It previously said account restrictions and changed addresses complicated independent tracing. The latest clarification narrows the suspected route without quantifying losses.

Services Suspended While Fund Review Continues

Unocoin detected suspicious infrastructure activity on November 6 and requested freezes from two providers. Fireblocks received its freeze request at 11:24 UTC, followed by BitGo at 11:29 UTC. After additional unauthorized activity was detected on November 9, the exchange suspended all services.

Investigators found compromised infrastructure, though the root cause remains unclear. Unocoin plans to rebuild its servers rather than restore the existing environment, estimating four to five working days for the rebuild, to be followed by security checks. Those steps, alongside the ongoing fund review, mark the milestones the exchange has set before services resume, while the identity of the signing keys and the root cause of the infrastructure compromise remain the outstanding unknowns.

More than 90% of customers' cryptocurrency funds remain in cold storage, a setup that keeps private keys offline rather than on internet-connected systems, according to the exchange. That figure does not establish whether other balances or customer information were exposed. Unocoin is reviewing holdings with BitGo and Fireblocks before restoring services.

Source: CoinCentral