Indian cryptocurrency exchange Unocoin has maintained its suspension of deposits and withdrawals while investigating suspicious transactions involving its BitGo wallet infrastructure. The exchange detected unauthorized activity on November 6 and requested immediate freezes of its enterprise accounts with BitGo and Fireblocks, which hold cryptocurrency balances for daily operations.
BitGo confirmed the freeze of Unocoin's enterprise account on November 6 at the exchange's request. However, outgoing transactions were reportedly signed and broadcast outside BitGo's platform after the account had been frozen, raising questions about how the transfers occurred.
Recovery Feature Under Investigation
Unocoin identified outgoing transactions from an Ethereum address within its BitGo wallet infrastructure on November 12. The address was used to fund ERC-20 tokens. The exchange suspects that BitGo's recovery feature—a mechanism that allows wallet holders to access their assets if BitGo becomes unavailable—may have been misused to authorize transactions outside the custodian's regular platform.
Unocoin has not confirmed whether the recovery feature was exploited or established who authorized the transactions.
Infrastructure Compromise and Response
Further unauthorized activity was detected on November 9, prompting Unocoin to suspend all services as a precautionary measure. Investigation established that the company's infrastructure had been compromised. The exchange decided to rebuild its entire server infrastructure rather than restore the potentially compromised environment, estimating the process would require approximately four to five working days as of November 12.
The company has not identified the precise cause of the breach or determined which systems and information may have been exposed.
Customer Assets and Cold Storage
Unocoin has emphasized that more than 90% of the cryptocurrency it holds on behalf of customers is maintained in cold storage, meaning assets are kept in offline wallets. However, the exchange has not provided a definitive assessment of funds potentially affected by the suspicious transfers.
The investigation is complicated by BitGo's enterprise accounts remaining frozen, preventing Unocoin from accessing them directly. The exchange has requested transaction-level information and further clarification from the custodian to establish complete transaction history.
Custody Security Implications
The incident highlights security challenges associated with cryptocurrency custody arrangements, particularly when recovery mechanisms provide alternative ways to access wallet funds. Multisignature wallets require multiple approvals before transactions can be completed, but recovery procedures and backup mechanisms also need to be secured as they create additional pathways for accessing funds.
