At a glance
- US custodian BitGo says the transactions that moved funds out of an Unocoin wallet were signed with Unocoin’s own user and backup keys and sent straight to the blockchain, without BitGo’s key, according to a technical write-up published on Friday.
- In an update to its incident page, Unocoin says the freeze it asked BitGo for worked as intended and that its wallet’s backup mechanism “seems to be exploited”. It has not given a loss figure or a date for services to return.
The Indian exchange’s wallet used a two-of-three setup: any two of three keys can approve a transfer. BitGo says Unocoin held two of them, the user key and the backup key, and BitGo held the third, which “was never used”.
On Thursday Unocoin said ether had left one of its BitGo wallets despite a freeze it requested on 6 Nov, and that it was waiting for BitGo’s findings. Those findings arrived on Friday.
What BitGo found
In a statement on X at 14:13 UTC (19:43 IST), BitGo said its systems were not breached and that no other clients were affected. It directed questions about customer funds to Unocoin.
Its blog post, shared at 20:25 UTC (01:55 IST on Saturday), names the two signing addresses.
The backup-key address appears as the sender of the transactions. The user key is recovered from a second signature carried inside the transaction data. BitGo says it matched both to Unocoin’s key records, and that Unocoin confirmed them.
The transfers were not limited to Ethereum. BitGo says they touched four networks: Ethereum, where ERC-20 tokens moved, the XRP Ledger, Hedera and EOS. Its detailed analysis covers only the Ethereum wallet.
Why the freeze did not stop it
A freeze at BitGo means BitGo stops signing for the wallet. It does not lock the coins on the blockchain, and it does not cancel the customer’s keys, BitGo says. Whoever holds the user key and the backup key together can satisfy the two-signature rule and send funds on their own.
That is the design of a self-custody wallet: the customer keeps enough keys to reach its funds even if the provider disappears. Unocoin made the same point in its update. A private key is the secret that approves a transfer, so whoever controls two of them controls the wallet.
BitGo says requests to build transactions through its platform on 9 Nov were blocked by the freeze. Its advice to Unocoin: shift whatever is left into fresh wallets with new keys.
What the blockchain shows
A CryptoWatchDesk check of public Ethereum data, using the Blockscout explorer, found 124 transactions sent from the backup-key address to the wallet contract between 9 Nov at 10:20 UTC (15:50 IST) and 11 Nov at 07:12 UTC (12:42 IST). Of these, 98 went through. The contract held no ether as of about 20:50 UTC on Friday.
Those dates fall before Unocoin’s 12 Nov update, which first reported the outgoing transactions. The count shows activity, not value: it does not tell us how much each transfer moved.
What we don’t know yet
Neither company has said how much crypto left the wallets, in rupees or dollars, or who used the keys. Unocoin says it is investigating how the backup mechanism was accessed, any loss of crypto and possible exposure of customer information.
Unocoin earlier said more than 90% of customer crypto is held in cold storage. It has not updated that figure, and its platform has been shut since 9 Nov while it rebuilds its servers. For background, see what a crypto custodian does.
Why it matters: the question for Unocoin’s users has shifted from whether a custodian failed to how the exchange’s own keys were reached. Until Unocoin publishes a loss figure, customers cannot tell whether their balances are affected. Use only Unocoin’s official blog and X account, and treat unsolicited “recovery” offers as likely scams.
Next, watch for Unocoin’s account of how much moved and when logins return.
This article is for information only and is not investment advice.