Unocoin Halts Operations as Unauthorized Transfers Bypass BitGo Freeze

Cryptocurrency platform Unocoin suspended all operations on Nov. 9 following ongoing unauthorized activity, sparking concerns among users asking whether the Unocoin exchange was hacked. The platform had initially observed suspicious activity on Nov. 6, prompting it to request immediate enterprise account freezes with custody providers BitGo and Fireblocks.

In a Nov. 13 statement, Unocoin revealed that disputed transfers were signed and broadcast entirely outside BitGo's systems. Although the freeze applied directly to the company's BitGo enterprise account functioned as intended, attackers appeared to have exploited a backup mechanism originally created to safeguard fund access if BitGo ever became unreachable.

Unocoin Hacked via External Backup Mechanism

BitGo's standard wallet architecture utilizes three distinct keys: a user key, a backup key, and a BitGo key. Routine operations require both the user and BitGo keys to satisfy a mandatory two-of-three multi-signature requirement. However, the system architecture allows the backup key to combine with either of the remaining two keys to fulfill that same threshold.

When a user key is combined with a backup key, transactions can be completed without involving BitGo's proprietary key. BitGo's withdrawal-policy documentation highlights that internal controls and account restrictions apply strictly to transactions routed directly through BitGo. As a consequence, alternative recovery transactions utilizing the user and backup keys completely bypass configured provider policies, meaning an account freeze cannot serve as a comprehensive block on every signature route.

Unauthorized wallet transactions bypassed BitGo account freezes by pairing user and backup recovery keys externally.

Unocoin noted that on Nov. 12, it detected unauthorized outgoing transfers originating from an Ethereum address within its BitGo wallet setup, which was typically utilized to fund ERC-20 tokens. In that earlier disclosure, the firm emphasized that more than 90% of customer digital assets were secured in offline cold storage. Nevertheless, Unocoin clarified that this figure does not conclude the comprehensive assessment of losses, as it continues to evaluate the full status of holdings and data exposure.

Why it matters

This incident highlights structural vulnerabilities in multi-signature custody arrangements when emergency recovery mechanisms operate outside standard administrative controls. For digital asset holders relying on custodial safeguards, the breach demonstrates that enterprise account freezes cannot prevent transfers if secondary recovery keys are compromised.

Unocoin continues to investigate how the alternate signing path was accessed, the exact scale of lost cryptocurrency, and the timeline for when customer services can safely resume.