BitGo Denies Breach as Unocoin Probes Unauthorized Wallet Transfers
BitGo said its systems were not breached and that disputed Unocoin wallet transfers were signed with two keys held by the Indian exchange, not its own. Unocoin is investigating suspected misuse of a backup recovery mechanism and has suspended customer logins.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What BitGo Says Happened
BitGo said in a Nov. 13 statement shared on X that its systems were not breached and that outgoing transactions from Unocoin's wallets were signed without its participation. The company said its review found the transactions were signed with Unocoin's user and backup keys and broadcast directly on-chain. BitGo said no other clients were affected and referred questions about customer funds to Unocoin.
The disputed transfers came from an Ethereum address within Unocoin's BitGo wallet infrastructure. Unocoin identified the activity on Nov. 12, several days after its account was frozen on Nov. 6, which BitGo said functioned as intended.
How the Signing Structure Matters
BitGo described Unocoin's wallets as using a 2-of-3 self-custody arrangement, in which Unocoin holds the user and backup keys and BitGo holds the third. Two keys are needed to authorize a transaction. BitGo's wallet documentation says a backup key can be combined with either of the other two keys, which means the company's key was not required for the transfers under review. The documentation also states that BitGo does not have access to clients' private user or backup keys.
BitGo's published recovery instructions describe how funds can be moved without its services, using the encrypted user key, backup key, wallet passphrase and destination address. Unocoin said the design is meant to preserve access to funds if BitGo becomes unavailable, and it suspects this recovery path was exploited.
Unocoin's Account and Open Questions
Unocoin said on Nov. 13 that it had received the information it requested from BitGo and acknowledged that the freeze appeared to work and that the transactions were signed and broadcast outside BitGo's platform. The exchange is investigating how the backup mechanism was accessed, whether any cryptocurrency was lost, and whether private information was exposed.
The two sides' accounts have shifted somewhat. On Nov. 12, Unocoin said frozen account access prevented it from reviewing the full transaction history through BitGo, and it had requested transaction-level data after spotting transfers from an ETH address used to fund ERC-20 tokens. Neither BitGo's statement nor Unocoin's clarification names the person who used the keys or confirms a loss figure.
Coverage has also varied on the scale of the incident. Earlier reporting by crypto.news, citing Onchain Lens, said Arkham Intelligence showed zero holdings across roughly 81,000 addresses associated with the exchange, while Unocoin has maintained that no customer funds were lost when it first suspended logins following unauthorized server access disclosed on Nov. 9. Those two positions have not been independently reconciled in the material reviewed. Unocoin's website was returning a 504 Gateway Time-out error on Nov. 12.
Why It Matters
For Traders
Unocoin customers and any counterparties holding exposure to its wallets should treat the unresolved loss question as the key variable until the exchange publishes a confirmed figure.
For Investors
The incident highlights custody-counterparty and operational-security risk at mid-size exchanges that rely on third-party multisig providers for client funds.
For Builders
Backup-key recovery paths in multisig custody can become attack surfaces, so key-holder separation and recovery-flow access controls need explicit threat modeling.
This article is for information only and is not financial advice. Read the full disclaimer.
