India’s oldest crypto exchange Unocoin points to BitGo backup mechanism after breach
- Unocoin says BitGo confirmed the freeze it placed on its custody account, but funds still left a wallet on-chain through a backup recovery path.
- The exchange is investigating who accessed that backup.
- Unocoin is also rebuilding its servers over four to five working days, with logins and withdrawals still suspended.
Unocoin says crypto left one of its wallets even though it froze its BitGo account in its latest update on the exploit it suffered.
Unicoin thinks a backup recovery path in BitGo’s (NYSE: BTGO) multisignature wallets was used to move its funds, but it does not know who the perpetrator is.
How did crypto leave a wallet that was frozen?
Unocoin asked BitGo to freeze its company accounts on November 6 after it spotted suspicious activity. Its blog says the freezes began at 11:24 UTC for Fireblocks and 11:29 UTC for BitGo. Both custodians confirmed the freezes, and no losses were found at that point.
However, on November 13, Unocoin said its money was moved out of the wallet that BitGo confirmed was frozen. Unocoin says BitGo’s multisignature wallets have a backup path that is meant to let a client reach funds even if BitGo goes offline.
Unocoin says this path “appears to have been exploited” and that it is now checking how it was reached and used.
BitGo’s own documents point fingers at its clients instead. Its Wallet Recovery Wizard lets clients take assets out of their wallets “without BitGo.” It uses the user key and the backup key to move funds to a new address.
BitGo’s documents say these recovery transactions “bypass any policies you have with BitGo.” The recovery wizard requires the backup public key, the user public key, the wallet passphrase, and either the BitGo public key or the wallet address to operate.
Who is to blame for Unocoin’s lost crypto?
Unocoin has not named who controlled the key, and it has also not stated how much crypto was lost. The company has confirmed, however, that more than 90% of customer crypto is in cold storage.
After Unocoin suspended all services on November 9, it traced outgoing transactions from an Ethereum address in its BitGo wallets and by November 12, it had found out that that address had been used to fund ERC-20 tokens.
Unocoin says BitGo’s change-address setup makes it hard to rebuild the full transaction history. It is now rebuilding its whole server stack, which it expects to take four to five working days.
Still on November 12, about 80,986 Unocoin-linked addresses on Arkham Intelligence showed a total value of zero. But the same report said those labeled wallets held only hundreds of dollars at most over the past month. Their three-month peak was just over $250,000.
In a situation similar to BitGo and Unocoin’s, WazirX and its custody partner Liminal spent months blaming each other after the $234 million WazirX hack in July 2024. Liminal claimed that all transactions originated from its client’s end, while WazirX argued that the loss was due to a fault in the Liminal platform.
Separately, BitGo recently reported its third-quarter results. It recorded a net income of $44.1 million, driven by a rise in the value of its digital asset treasury. The company’s report puts the unrealized gain at $71.5 million.
If you're reading this, you’re already ahead. Stay there with our newsletter.
FAQs
What did BitGo tell Unocoin about the frozen account?
BitGo confirmed that Unocoin's enterprise accounts were frozen on instruction on November 6 and that the freeze functioned as intended, according to Unocoin's November 13 update. BitGo said the disputed transactions were signed and broadcast on-chain externally, without using its platform.
How could funds move if the account was frozen?
Unocoin says a backup mechanism in BitGo's multisignature wallets appears to have been exploited. BitGo's own docs describe a Wallet Recovery Wizard that uses the user key and backup key to move assets without BitGo and bypass its policies.
Did Unocoin lose customer funds?
Unocoin has not confirmed any loss and says more than 90% of customer crypto is in cold storage. A November 12 report found about 80,986 Unocoin-linked Arkham addresses showing zero, but those wallets had held only small balances historically.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Hannah Collymore
Hannah is a writer and editor with nearly a decade of blog writing and event reporting experience in the crypto space. At Cryptopolitan, Hannah contributes to the news page, reporting and analyzing the latest developments in DeFi, RWA, crypto regulation, AI and frontier tech industries. She graduated from Arcadia university with a degree in Business Administration.
