Unocoin says cryptocurrency left one of its wallets even after it froze its BitGo account, according to its latest update on the exploit, which was also shared on X. The exchange believes a backup recovery path in BitGo’s (NYSE: BTGO) multisignature wallets was used to move its funds, though it has not identified who was behind the move. For anyone holding assets with a custodian, the sequence is a reminder that a freeze confirmed on the custodian’s side does not by itself cover every route to the funds.

How did crypto leave a wallet that was frozen?

Unocoin asked BitGo to freeze its company accounts on November 6 after spotting suspicious activity. Its blog says the freezes began at 11:24 UTC for Fireblocks and 11:29 UTC for BitGo. Both custodians confirmed the freezes, and no losses were found at that point.

However, on November 13, Unocoin reported that its funds had been moved out of the wallet BitGo had confirmed was frozen. The company says BitGo’s multisignature wallets include a backup path designed to let a client reach funds even if BitGo goes offline.

Unocoin says this path “appears to have been exploited” and that it is now checking how it was reached and used.

BitGo’s own documentation points at its clients instead. Its Wallet Recovery Wizard lets clients take assets out of their wallets “without BitGo,” using the user key and the backup key to move funds to a new address. BitGo’s documents state that these recovery transactions “bypass any policies you have with BitGo.” The recovery wizard requires the backup public key, the user public key, the wallet passphrase, and either the BitGo public key or the wallet address to operate.

Who is to blame for Unocoin’s lost crypto?

Unocoin has not named who controlled the key, and it has also not stated how much crypto was lost. The company has confirmed, however, that more than 90% of customer crypto is in cold storage.

After Unocoin suspended all services on November 9, it traced outgoing transactions from an Ethereum address in its BitGo wallets, and by November 12 it had found that the address had been used to fund ERC-20 tokens. Unocoin says BitGo’s change-address setup makes it hard to rebuild the full transaction history. It is now rebuilding its whole server stack, which it expects to take four to five working days. Those threads — who controlled the key, how much crypto moved, and what the rebuilt server stack reveals — are the ones Unocoin’s progress updates are tracking.

Also on November 12, about 80,986 Unocoin-linked addresses on Arkham Intelligence showed a total value of zero. The same report said, however, that those labeled wallets held only hundreds of dollars at most over the past month, with a three-month peak of just over $250,000.

In a situation similar to the BitGo–Unocoin dispute, WazirX and its custody partner Liminal spent months blaming each other after the $234 million WazirX hack in July 2024. Liminal claimed that all transactions originated from its client’s end, while WazirX argued that the loss was due to a fault in the Liminal platform, as reported at the time. In both cases, the unresolved question is which party’s keys or systems set the outflows in motion — the same point Unocoin says it is still investigating for its own loss.

Separately, BitGo recently reported its third-quarter results. The company recorded a net income of $44.1 million, driven by a rise in the value of its digital asset treasury, with the report putting the unrealized gain at $71.5 million.