Unocoin Suspects BitGo Wallet Backup Path Was Exploited
Unocoin says transfers bypassed BitGo’s platform through a suspected wallet backup route. The loss amount and possible data exposure remain under review.
Key Notes
- Unocoin suspects the backup mechanism in its BitGo multisignature wallets was exploited.
- The exchange says the account freeze worked and the disputed transactions were signed outside BitGo’s platform.
- The loss amount and possible data exposure remain under investigation while services are suspended.
Indian crypto exchange Unocoin says a backup mechanism in its BitGo multisignature wallets appears to have been exploited during its ongoing security incident. The exchange says the disputed transactions were signed and broadcast directly onchain, outside BitGo’s platform.
The November 13 addition to Unocoin’s incident update also says BitGo’s enterprise-account freeze functioned as intended. That narrows its preliminary explanation of how transfers could occur after the company requested restrictions on its accounts.
Transfers Took Place Outside BitGo’s Platform
Unocoin says it received the information and clarifications it had requested from BitGo. Its account of that exchange states that the relevant transactions did not pass through BitGo’s platform or involve its participation.
The exchange suspects a recovery feature designed to preserve access to funds if BitGo becomes unavailable. It is still investigating how that mechanism was accessed and used, along with potential cryptocurrency losses and information-privacy issues.
The explanation remains Unocoin’s assessment. It has not published a transaction-level reconstruction identifying the exact signing credentials used, the initial route of compromise or a confirmed loss total.
Backup Keys Provide an Alternative Signing Route
BitGo’s wallet documentation describes a three-key model comprising a user key, a backup key and a BitGo key. Normal transactions use the user and BitGo keys to satisfy a two-of-three signing requirement.
The backup key can instead be combined with either of the other two keys. For self-custody wallets, BitGo says the private user and backup keys are created on the client side and are not accessible to the company.
That design provides a route to recover assets without depending on the usual signing service. Unocoin’s statement points to that alternative route, rather than a failure of the requested platform freeze. It does not establish that BitGo’s own infrastructure was compromised.
The exchange has not disclosed enough detail to determine precisely which keys or other credentials an attacker obtained. General descriptions of BitGo’s architecture cannot substitute for the incident’s eventual technical findings.
Services Remain Suspended as Investigation Continues
Unocoin’s published timeline dates the initial suspicious activity to November 6. It requested Fireblocks and BitGo enterprise-account freezes that day and suspended all services after detecting further unauthorized activity on November 9.
On November 12, Unocoin identified outgoing transfers from an Ethereum address in its BitGo setup used for ERC-20 token funding. It subsequently sought transaction details while preparing to rebuild its server infrastructure, an exercise estimated at four to five working days.
The latest disclosure advances the earlier breach report, which described restricted logins and questions about tracked wallet balances. A reported zero balance across an attributed address set did not establish the amount stolen.
Unocoin says more than 90% of customer cryptocurrency is held in cold storage, while its complete holdings assessment remains underway. The rebuild estimate is not a confirmed reopening date, and the latest update gives no final loss figure or assurance that every customer asset is unaffected.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
