Unocoin Halts Services After Suspected Misuse of BitGo Backup Key Route
Indian exchange Unocoin has suspended deposits, withdrawals and all services since November 9 after detecting unauthorized transfers from its BitGo wallet infrastructure. The company says the disputed transactions were signed and broadcast outside BitGo through a backup recovery mechanism, and losses remain under investigation.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Unocoin Has Reported
Indian cryptocurrency exchange Unocoin suspended all services on November 9 after detecting further unauthorized activity, according to its incident update. The company first detected the activity on November 6 and asked BitGo and Fireblocks to freeze its enterprise accounts at each provider. Unocoin said on November 13 that the freeze on its BitGo enterprise account had so far worked, but that disputed transfers were signed and broadcast outside BitGo.
In its November 12 report, Unocoin said it had identified outgoing transactions from an Ethereum address within its BitGo wallet infrastructure that was used to fund ERC-20 tokens. The exchange said more than 90% of customer cryptocurrency funds were held in cold storage, but it also said it was still establishing the complete status of holdings and potential exposure, so that figure does not settle the loss assessment.
How a Recovery Route Can Bypass a Provider Freeze
BitGo's wallet documentation describes three keys: a user key, a backup key and a BitGo key. Normal transactions require two of the three, typically the user and BitGo keys. The backup key is designed to pair with either of the other two, which allows a recovery route that does not involve BitGo's key if the provider becomes unavailable.
BitGo states in its withdrawal-policy documentation that its policies apply only to transactions involving BitGo. Transactions signed with the user and backup keys therefore fall outside those policies. Unocoin's update says the backup mechanism appeared to have been exploited, but the exact keys and process used in this incident have not been independently established, and the documentation describes the general design rather than a reconstruction of the event.
Open Questions and Next Steps
Unocoin says it is still investigating how the recovery mechanism was accessed, the size of any cryptocurrency losses, and whether information was exposed. Its latest update says work to restore services is continuing, but it has not given a timeline for resumption. The company's reports to date are its own statements; no independent audit or regulator finding was cited in the sources.
Why It Matters
For Traders
Unocoin users cannot currently deposit or withdraw, and the size of any losses has not been disclosed, so exposure to Indian exchange counterparty risk remains unresolved.
For Investors
The incident highlights that custodian freezes may not cover every signing combination a wallet supports, a risk that matters for any institutional custody arrangement.
For Builders
Teams using multi-key wallet setups should audit which key pairs can sign without the provider and whether provider policies actually cover those recovery paths.
This article is for information only and is not financial advice. Read the full disclaimer.
