BitGo Says Unocoin Transfers Were Signed With Two Unocoin Keys
BitGo says its systems were not breached and the disputed Unocoin transfers were signed with the exchange's own user and backup keys. Unocoin suspects misuse of a backup mechanism, gives no loss figure, and services remain suspended during a server rebuild.
Two of three keys signed the disputed Unocoin transfers. BitGo says both belonged to Unocoin. In a Nov. 13 statement on X, the custodian said its systems were not breached and the transfers moved without its participation.
The structure matters. Unocoin ran a 2-of-3 self-custody wallet: Unocoin held the user and backup keys, BitGo held the third. Two keys authorize a transaction, so the two Unocoin keys were enough to sign and broadcast onchain. BitGo's own recovery documentation describes signing and broadcasting transactions without BitGo services.
"BitGo's key was never used,"
BitGo said no other clients were affected and directed questions about customer funds to Unocoin.
Unocoin: signed outside BitGo
Unocoin's Nov. 13 incident update acknowledged the transactions were signed and broadcast outside BitGo's platform. It suspects a backup mechanism, built to preserve access if BitGo became unavailable, was exploited. The company is investigating the mechanism, cryptocurrency losses and information privacy.
Neither company says who used the keys. The key structure explains how transfers can happen without BitGo. It does not establish who is responsible for any loss.
Timeline and open questions
Unocoin said it first detected suspicious activity on Nov. 6 and asked both Fireblocks and BitGo to freeze its enterprise accounts. The requests went in at 11:24 UTC for Fireblocks and 11:29 UTC for BitGo. Both providers confirmed the freezes, and BitGo said its freeze worked as intended.
On Nov. 12, Unocoin found outgoing transactions from an Ethereum address in its BitGo wallet infrastructure. That is the discovery date. Neither statement says when the transfers were executed. We first reported the flagged ETH outflow on Nov. 12.
Unocoin told users on Nov. 13:
"No user funds have been lost, and your assets remain safe."
Its own notice, though, says it is still investigating crypto losses and the status of its holdings. No confirmed loss figure. The company said more than 90% of customer crypto sat in cold storage. A Nov. 12 Arkham snapshot listed 80,986 attributed Unocoin addresses with no priced token holdings. That alone does not prove theft or show when balances changed.
What users face
Unocoin disclosed unauthorized server access on Nov. 9 and disabled customer logins. It later suspended all services after further unauthorized activity and concluded its infrastructure was compromised. A server rebuild runs an estimated four to five working days, followed by security checks. Withdrawals and pending requests will be processed once services return. No fixed date.
BitGo's account puts the signing on the client side of a shared-key setup. Unocoin points to an exploited backup mechanism. Until Unocoin publishes a loss figure and says who used the keys, users have only its assurance that funds are safe.
