Unocoin Keeps Withdrawals Frozen After Suspicious BitGo Transfers

Indian cryptocurrency exchange Unocoin has kept deposits and withdrawals suspended as it investigates suspicious transfers from wallets tied to custodian BitGo, which says its own systems were not breached. According to Bitcoinist, the exchange’s review now centres on whether a wallet recovery feature was used to move funds after its BitGo enterprise account had already been frozen.

The dispute over what happened has sharpened in the past two days. BitGo said in a November 13 statement on X that the freeze it applied on November 6 functioned as intended, and that the transfers under review were signed with keys held by Unocoin and broadcast on-chain without BitGo’s participation.

Also readBlackRock crypto ETFs lose $4.77 billion in November

Two accounts of how the transfers were signed

Unocoin’s explanation, issued through its post on X, is that BitGo’s multisignature setup includes a recovery mechanism allowing wallet holders to reach their assets if BitGo becomes unavailable. The exchange suspects that mechanism may have been misused and said it is investigating how it was accessed, whether any cryptocurrency was lost, and whether private information was exposed. It has acknowledged that the freeze appeared to work and that the transactions were signed and broadcast outside the custodian’s platform.

crypto.news reported BitGo’s fuller account: the outgoing transactions were signed using the user and backup keys held by the exchange, and BitGo’s key played no part. BitGo’s wallet documentation, cited in that report, describes the same signing structure, noting that normal transactions pair the user key with BitGo’s key, while the backup key can be combined with either of the other two. The documentation also says BitGo does not hold private user or backup keys in self-custody setups.

Also readKalshi Ties Up With BitGo for Bitcoin-Backed Futures Margin

Neither BitGo’s statement nor Unocoin’s November 13 clarification names who used the keys or gives a confirmed loss figure. Unocoin has said it will not give assurances about customer holdings until the relevant information is verified.

What Unocoin has disclosed about the breach

The episode began on November 6, when Unocoin detected unauthorized activity within its infrastructure and requested the freezes at 11:24 UTC for Fireblocks and 11:29 UTC for BitGo, according to crypto.news. After more unauthorized activity on November 9, it suspended all services. The exchange later established that its infrastructure had been compromised, though it has not identified the precise cause or determined which systems and information may have been exposed.

It opted to rebuild its entire server infrastructure rather than restore a potentially compromised environment, and its November 12 notice estimated that would take about four to five working days.

The exchange says its BitGo enterprise accounts remain frozen, which it says limits its own access to transaction records. It has also pointed to BitGo’s use of change addresses, which it says makes full transaction history hard to reconstruct from public blockchain data, and it has asked the custodian for transaction-level information.

Why it matters

Unocoin’s customers are the immediate parties affected: their funds are locked while the exchange and its custodian give conflicting emphasis on who controlled the keys behind the transfers. The case also puts a spotlight on recovery paths built into multisignature custody. Requiring multiple approvals is meant to harden wallets, but a backup mechanism intended to keep holders in control if a custodian fails is itself an alternative route to signing, and the security of that route depends entirely on who holds the keys. Cointelegraph noted a November 5 warning from India’s cybersecurity agency about an AI-assisted campaign targeting crypto exchanges and other financial firms, while stating that no link to Unocoin’s incident has been established. Unocoin also has not provided a definitive assessment of the funds potentially affected.

What to watch

The next concrete signals are Unocoin’s completion of its server rebuild and its verification of transaction-level data from BitGo, which the exchange says must happen before it will speak to the status of customer holdings. Cointelegraph reported that neither Unocoin nor BitGo responded to its request for further information before publication, so follow-up statements from either party, and any confirmed loss figure, will be the points at which this account is tested.

Sources: Bitcoinist, crypto.news, Cointelegraph