Crypto exchange Unocoin suspended all services on November 9 after detecting unauthorized activity on its platform. The exchange had initially identified suspicious activity on November 6 and requested account freezes at both BitGo and Fireblocks.
On November 13, Unocoin reported that disputed wallet transfers were signed and broadcast outside BitGo, despite the freeze on its enterprise account having remained in effect. The exchange is investigating how a backup mechanism designed to preserve fund access during BitGo unavailability was exploited.
How the backup signing route works
BitGo wallets use a two-of-three key signing requirement involving a user key, backup key, and BitGo key. Normal transactions require the user and BitGo keys. However, the backup key can pair with either the user key or BitGo key to meet the two-of-three requirement.
When the backup key pairs with the user key, transactions can be signed without BitGo's involvement. BitGo's documentation notes that withdrawal policies configured with the provider only apply to transactions involving BitGo's key. Recovery transactions using the user and backup keys bypass these withdrawal policies.
This recovery capability exists to preserve access to funds if the provider becomes unavailable, which helps explain why a provider account freeze cannot restrict every transaction combination the wallet's keys can sign.
Investigation underway
Unocoin reported identifying outgoing transactions on November 12 from an Ethereum address within its BitGo wallet infrastructure used to fund ERC-20 tokens. The exchange attributed the disputed activity to external signing while the suspected misuse of backup access remains under investigation.
According to Unocoin's November 12 report, more than 90% of customer cryptocurrency funds were maintained in cold storage. The exchange is still establishing the complete status of holdings and potential exposure.
Unocoin's latest update indicated work to restore services is ongoing, with unresolved questions remaining about how the suspected recovery path was accessed, what losses or information exposure occurred, and when services can resume.
