TLDR
- Unocoin suspects exploitation of a multisignature wallet backup mechanism following unauthorized blockchain transactions.
- BitGo’s enterprise account freeze operated as intended, according to Unocoin’s November 13 update.
- Investigators found that the disputed transactions were signed and broadcast outside BitGo’s platform.
- Unocoin identified outgoing transfers from an Ethereum address supporting ERC-20 token operations.
- The exchange suspended all services on November 9 after detecting further unauthorized activity.
Indian cryptocurrency exchange Unocoin suspects its BitGo multisignature wallet backup mechanism was exploited. The finding followed outgoing transactions despite an enterprise account freeze implemented on November 6. In a November 13 update, Unocoin said those transactions were signed and broadcast outside BitGo.
BitGo Freeze Worked, Unocoin Says
Unocoin received clarifications from BitGo after identifying questionable Ethereum wallet activity on November 12. BitGo confirmed its enterprise account freeze took effect on November 6, Unocoin said.
However, the transactions were signed externally and broadcast directly on-chain without BitGo’s platform or involvement.
Unocoin suspects an emergency wallet recovery mechanism was used to access the funds. The exchange has not established how it was accessed or who authorized the transfers. Account restrictions and blockchain transaction signing depend on different controls.
Backup Signing Mechanism Under Investigation
BitGo’s wallet documentation describes a two-of-three signing system using user, backup, and BitGo keys. Normal transactions use the user and BitGo keys, while a backup key supports recovery. The documentation says two available keys can complete a transaction without the standard signing combination.
Unocoin has not identified which keys signed the disputed transactions or how access occurred. Its statement does not establish a breach of BitGo’s platform or a failure of its freeze. No transaction hashes, destination addresses, or verified loss amount were disclosed.
On November 12, Unocoin reported transfers from an Ethereum address used to fund ERC-20 tokens. It previously said account restrictions and changed addresses complicated independent tracing. The latest clarification narrows the suspected route without quantifying losses.
Services Suspended While Fund Review Continues
Unocoin detected suspicious infrastructure activity on November 6 and requested freezes from two providers. Fireblocks received its freeze request at 11:24 UTC, followed by BitGo at 11:29 UTC. Additional unauthorized activity on November 9 prompted Unocoin to suspend all services. Investigators found compromised infrastructure, though the root cause remains unclear. Unocoin plans to rebuild its servers rather than restore the existing environment.
Unocoin estimates four to five working days for rebuilding, followed by security checks. More than 90% of customers’ cryptocurrency funds remain in cold storage, it says. That figure does not establish whether other balances or customer information were exposed. Unocoin is reviewing holdings with BitGo and Fireblocks before restoring services.
