Crypto exchange Unocoin, an India-based cryptocurrency trading platform, said on Nov. 13 that the disputed wallet transfers were signed and broadcast outside of BitGo, an institutional digital-asset custody provider, while the freeze on its BitGo enterprise account had functioned as intended up to that point.

The exchange suspended all of its services on Nov. 9 after detecting additional unauthorized activity. It had earlier requested freezes on its enterprise accounts held with both BitGo and Fireblocks, an enterprise digital-asset infrastructure firm, after first noticing the activity on Nov. 6. For customers, a full suspension means trading and withdrawals remain unavailable until the exchange restores operations.

In an incident update, Unocoin said a backup mechanism designed to preserve access to funds in the event that BitGo became unavailable appeared to have been exploited. The company is still investigating how that mechanism was used, the extent of cryptocurrency losses, and any potential exposure of information.

Two routes to a wallet signature

BitGo's wallet documentation describes a three-key structure: the user key, the backup key, and the BitGo key. Normal transactions use the user and BitGo keys to satisfy a two-of-three signing requirement. The backup key, however, can be paired with either of the other two keys.

Splitting signing authority across multiple keys is a mainstay of institutional crypto custody, since it prevents any single key holder from moving funds unilaterally.

Pairing the backup key with the user key creates a signing route that does not require BitGo's key, and the two-of-three requirement still applies in that recovery arrangement. What changes is which pair of keys is used to meet it: the user and backup keys replace the usual user-and-provider combination, leaving BitGo outside the signing process entirely.

BitGo acknowledges this limitation in its withdrawal-policy documentation, noting that such policies apply only to transactions involving BitGo. Recovery transactions signed with the user and backup keys bypass the policies configured with the provider.

This recovery capability preserves access to funds when the provider is unavailable, and it helps explain why an account freeze cannot be treated as a blanket restriction on every transaction the wallet's keys are able to sign.

Ongoing investigation

Unocoin reported identifying outgoing transactions on Nov. 12 from an Ethereum address within its BitGo wallet infrastructure that was used to fund ERC-20 tokens, assets issued on Ethereum under a widely used token standard. Its Nov. 13 explanation attributes the disputed activity to external signing, while the suspected misuse of backup access remains under investigation.

In its Nov. 12 report, Unocoin said more than 90% of customer cryptocurrency funds were maintained in cold storage, meaning private keys are kept on systems that are not connected to the internet. The company was still establishing the complete status of its holdings and potential exposure, so that statement does not settle the loss assessment.

According to Unocoin's latest update, work to restore services is continuing. Unresolved questions include how the suspected recovery path was accessed, what losses or information exposure resulted, and when services can resume.