Unocoin Probes Suspected BitGo Wallet Recovery Exploit

Indian cryptocurrency exchange Unocoin is investigating whether a recovery mechanism in BitGo multisignature wallets was exploited to execute unauthorized cryptocurrency transfers, as its platform remains suspended following a security breach detected on November 6. In a November 13 update, Unocoin said BitGo had confirmed that its enterprise account was frozen as requested and that the freeze appeared to have worked as intended. However, transactions identified in wallets associated with the custodian were signed and broadcast directly on-chain without passing through BitGo's platform. The findings have shifted attention toward a backup mechanism that allows wallet holders to recover cryptocurrency if BitGo becomes unavailable. Unocoin suspects that this feature was exploited but has not established how the transactions were authorized, whether private keys were compromised or how much cryptocurrency may have been lost. The exchange has not announced a date for restoring customer access, deposits, withdrawals or trading.

How Could Transactions Bypass BitGo's Account Freeze?

Unocoin initially detected suspicious activity on November 6 and requested immediate freezes of its enterprise accounts with two custody providers, Fireblocks and BitGo. The Fireblocks freeze was requested at 11:24 UTC, followed by BitGo at 11:29 UTC. Both providers subsequently confirmed that the accounts had been frozen, preventing further transactions through their respective platforms. Nevertheless, Unocoin identified outgoing transactions on November 12 from an Ethereum address within its BitGo wallet infrastructure. The address had been used to fund ERC-20 token operations. After receiving additional information from BitGo, Unocoin said the transactions had been signed and broadcast externally. That distinction suggests the transfers did not require access to BitGo's normal transaction-processing infrastructure. BitGo's multisignature wallet architecture includes a recovery mechanism designed to preserve access to assets if the custodian becomes unavailable. Such arrangements can allow transactions to be authorized independently of the provider, subject to the relevant wallet's recovery configuration and signing requirements. Unocoin believes this mechanism may have been misused. However, the exchange has not disclosed which signing credentials were involved, how an unauthorized party could have obtained the necessary authorization or whether the suspected exploitation occurred before or after the account freeze. The available information does not establish that BitGo's platform was compromised or that a vulnerability exists in its custody software.

Investor Takeaway

The incident exposes an important distinction between freezing access to a custody platform and preventing transactions through independent wallet recovery arrangements. If external signing credentials remain usable, an account-level restriction may not be sufficient to stop unauthorized blockchain transfers.

What Is Known About Unocoin's Customer Funds?

Unocoin has not confirmed any cryptocurrency losses. Its November 6 assessment found no missing funds at the time, but subsequent discoveries have left the final financial impact unresolved. The exchange said more than 90% of customer cryptocurrency holdings are maintained in cold storage. It is working with BitGo and Fireblocks to establish the status of its assets and investigate potentially unauthorized transactions. Unocoin previously reported that its frozen BitGo accounts prevented it from accessing complete transaction records. The use of change addresses within the wallet infrastructure also complicated attempts to reconstruct activity independently through blockchain data. The company has since received additional clarification from BitGo, although it has not published a complete transaction history, affected wallet balances or a verified estimate of any losses. The new findings follow earlier concerns about the exchange's wallet visibility. On November 12, FinanceFeeds reported that approximately 81,000 Unocoin-attributed addresses displayed zero portfolio value on Arkham Intelligence. That observation did not establish that customer assets had been stolen, because externally attributed addresses do not necessarily represent an exchange's complete custody holdings. Without a verified reconciliation of customer liabilities and available assets, neither the displayed wallet balances nor the exchange's cold-storage percentage establishes its complete financial exposure.

Investor Takeaway

The immediate financial question is whether unauthorized transactions created a shortfall in assets backing customer balances. The 90% cold-storage figure provides useful context about asset allocation, but it is not a verified loss assessment or a guarantee that all customer holdings are unaffected.

Why Is Unocoin Rebuilding Its Server Infrastructure?

The custody investigation is running alongside a broader security response involving Unocoin's own systems. After detecting further unauthorized activity on November 9, the exchange suspended all services and disabled customer logins. Its investigation subsequently established that its server infrastructure had been compromised, although the affected systems and potential exposure of customer information remain under review. Rather than restore the existing environment, Unocoin decided to rebuild its server infrastructure from the ground up. On November 12, it estimated that the work would require approximately four to five working days, followed by security checks before operations could resume. That estimate is not a confirmed reopening date. The exchange said on November 13 that its investigation and restoration work were continuing. The incident follows other security failures involving cryptocurrency transaction authorization. In September, security researchers examining Bitget's $387.5 million breach identified manipulation of its transaction-signing process, illustrating how unauthorized transfers can occur without conventional private-key theft. Separately, Indian exchange CoinDCX disclosed a $15.99 million USDT loss in October after an automated wallet-sweeping failure allowed deposits to accumulate in previously compromised infrastructure. Neither incident has an established connection to Unocoin, and the technical causes should not be treated as equivalent.

Investor Takeaway

Unocoin's recovery depends on more than rebuilding servers. The exchange must establish how the suspicious transactions were authorized, determine whether customer assets or information were exposed, and verify that its custody arrangements can operate securely before restoring services. No confirmed restoration schedule or final loss figure has been disclosed.