Unocoin’s Frozen BitGo Account Did Not Stop Transfers Signed With Its Own Backup Keys

Unocoin’s security incident highlights a distinction that can get lost in the word “freeze”: disabling a custody provider’s platform is not necessarily the same as disabling every key that can authorize a transaction. The Indian exchange says transfers from a wallet associated with its BitGo infrastructure were signed and broadcast directly on-chain, outside BitGo’s platform, using a backup mechanism that appears to have been exploited. BitGo says its own key was not used in the transactions it reviewed. Neither company has yet published a complete accounting of any losses.

The exchange has suspended all services since 9 November and says it is rebuilding its servers. The case is a reminder that wallet security depends not only on the custodian’s controls but on how customer-held signing keys and recovery routes are protected.

What Unocoin says happened

Unocoin’s incident update, posted 12 November and amended the following day, traces the response to suspicious activity first detected on 6 November. The company says it asked BitGo and Fireblocks to freeze its enterprise accounts that morning. It reported receiving confirmation that both platform accounts were frozen, and said it had not identified a loss of cryptocurrency at that initial stage.

Further unauthorized activity was detected on 9 November. Unocoin then suspended all services as a precaution and concluded that its own infrastructure had been compromised. On 12 November it reported finding outgoing transactions from an Ethereum address in its BitGo wallet infrastructure, used to fund ERC-20 tokens. Because the accounts remained frozen and it could not log in to inspect the full history, Unocoin said it did not yet have a complete view of potentially unintended transactions.

The platform freeze and the on-chain keys were different controls

The key clarification came in updates published on 13 November by both companies. Unocoin said BitGo’s freeze had functioned as intended: the transactions in question were signed and broadcast externally without BitGo’s platform or involvement. BitGo’s account of the reviewed Ethereum activity is more specific. It says Unocoin’s wallet used a two-of-three multisignature arrangement: Unocoin held the user and backup keys, while BitGo held the third. The transfers BitGo examined used the two Unocoin-held keys; BitGo says its own key was not involved.

That design leaves an important boundary. Freezing the enterprise account instructs BitGo not to process or sign transactions through its platform. It does not, by itself, revoke the customer’s keys or prevent someone who controls the required customer-held keys from constructing and broadcasting a valid transaction directly to the blockchain. The arrangement is self-custodial in that sense: the customer retains an independent route to access funds, including if the provider becomes unavailable. The same resilience path can become a risk if its keys are exposed together.

What remains unknown about the transfers

Unocoin has not disclosed a final loss figure, a full transaction list, or a confirmed explanation for how the backup mechanism was accessed. Its 13 November update said it was still investigating the mechanism, possible cryptocurrency losses and potential privacy exposure. A statement that more than 90% of customer cryptocurrency was in cold storage is not a complete reserve reconciliation and does not settle what happened to the assets involved in the disputed wallet activity.

BitGo’s public technical account says its review of the Ethereum transactions found no corresponding transaction-initiation records on its platform and that the BitGo key was not used. It says platform controls blocked requests routed through BitGo after the freeze. The two statements describe different parts of the system and are compatible: the custodian’s platform may have remained locked while a customer-held signing path operated independently. The investigation may clarify whether other networks or wallets were involved.

Why an emergency freeze cannot replace key recovery

A platform freeze is useful for stopping ordinary requests that pass through the provider. It can buy time, limit routine withdrawals and give investigators a defined boundary. But it cannot make a compromised private key safe. If attackers can still meet the wallet’s signing threshold outside the provider’s service, they may be able to create transactions that the platform cannot intercept.

The practical response to suspected key exposure is therefore broader than changing passwords or freezing an account. Wallet owners generally need to determine which keys and devices may be affected, move any safe remaining assets to wallets created with newly generated keys, and preserve transaction and access logs for forensic review. BitGo has publicly advised Unocoin to move remaining funds to new wallets backed by newly generated keys. These are general incident-response principles, not confirmation that Unocoin has completed a migration.

A second problem: visibility during an incident

Unocoin said its frozen account access and the wallet architecture’s use of change addresses limited its ability to assemble the complete transaction history independently. That gap matters because a familiar platform dashboard may not show every transaction when signing and broadcasting can happen outside the service. A useful incident plan should identify how to monitor addresses directly on-chain, reconcile change outputs, and obtain complete transaction-level records from custody partners.

For customers, service suspension means they cannot use the exchange normally while the review and rebuild continue. The company said it expects the infrastructure rebuild to take about four to five working days, but that was an estimate—not a confirmed reopening date. Its update says it will run security checks before restoring operations.

What customers and other exchanges should watch

For Unocoin customers, the key questions are whether the exchange can publish a reconciled account of affected assets, clarify whether personal information was exposed, and explain what safeguards will be in place before service resumes. Customers should rely on verified notices from the exchange and avoid unsolicited messages claiming to offer recovery or refunds; incidents involving inaccessible accounts can attract impersonation scams.

For exchanges and wallet operators, the case is a reminder to model recovery keys as part of the live threat surface, not as a risk-free emergency spare. Test whether a platform freeze also constrains independent signing paths, ensure backup keys are stored separately, and make sure incident teams can reconstruct transactions even when dashboards or account access are unavailable. Those controls do not eliminate compromise, but they make the limits of each safeguard explicit before a crisis.

The investigation is still developing

As of 14 November, Unocoin had not published a final accounting of losses or a confirmed root cause. The exchange says the BitGo enterprise freeze worked for activity through the platform, while the transfers under review were signed outside it. That distinction explains how both statements can be true—but it does not yet answer how the customer-held backup route was accessed, how much may have moved, or whether customer data was exposed. Those remain open questions for the investigation.