BitGo Claims It Did Not Participate in Transactions After Unocoin Account Freeze

BitGo stated that its systems were not breached during the incident with the Indian cryptocurrency exchange Unocoin. According to the results of an internal investigation, transactions from the exchange's wallet were signed with two keys controlled by Unocoin and sent directly to the network without BitGo's involvement. The company reported this in a post on X on November 13.

Unocoin wallets use a self-custody scheme with 2-of-3 key distribution. The exchange controls the user and backup keys, while BitGo holds the third. To confirm a transaction, any 2 out of the 3 keys are required. BitGo emphasized that its own key was not used in the disputed transfers, and other clients of the company were not affected.

According to BitGo's documentation, regular operations are confirmed with the user key and the platform key. However, the backup key allows signing a transaction in combination with either of the other two. This scheme also enables asset recovery without using BitGo's services. The company does not have access to clients' private user and backup keys.

Unocoin suspects that attackers exploited the backup mechanism and is investigating how they gained access to it. The exchange is also checking whether any crypto assets were lost and if users' personal information might have been exposed. The confirmed amount of damage and the identity of the person who used the keys have not yet been disclosed by the companies.

Unocoin detected suspicious activity on November 6 and requested account freezes from Fireblocks at 11:24 UTC and from BitGo at 11:29 UTC. Both companies confirmed the execution of the requests. However, on November 9, the exchange identified further unauthorized activity and suspended all services. On November 12, Unocoin reported transfers from an Ethereum address used to replenish ERC-20 token reserves.

Due to the account freeze, the exchange could not view the full transaction history through BitGo and requested detailed information about the operations from the provider. On November 13, Unocoin confirmed that it received the necessary clarifications from BitGo and that the transfers occurred outside the wallet provider's platform.

According to the exchange, more than 90% of client crypto assets were stored in cold wallets. Unocoin reported a compromise of its server infrastructure but continues to investigate which systems were affected and what information might have been accessed by outsiders. The company allocated 4–5 business days for server recovery and protection. Additional security checks must be completed before services resume.