Unocoin Suspects BitGo Multisig Backup Exploit After Transactions Bypass Account Freeze

Unocoin BitGo Multisig Backup Exploit Raises New Crypto Custody Concerns

The Unocoin BitGo multisig backup exploit investigation has raised questions about cryptocurrency wallet recovery mechanisms after the Indian exchange reported outgoing blockchain transactions despite an account freeze.

On November 13, 2026, Unocoin provided an important update about the security incident that began one week earlier.

The company said it had received information and clarifications from digital asset custody provider BitGo concerning transactions that appeared to originate from its wallet infrastructure.

According to Unocoin's account of those explanations, BitGo froze the exchange's enterprise account on November 6 as instructed, and the freeze operated as intended.

However, the transactions under investigation were reportedly signed and broadcast directly to the blockchain without passing through BitGo's platform.

Unocoin suspects that a backup mechanism associated with BitGo's multisignature wallet architecture may have been used to authorize the transfers.

This creates an important distinction.

The incident does not necessarily indicate that BitGo failed to enforce its platform-level freeze.

Instead, it raises the possibility that transactions were authorized through an alternative signing arrangement outside BitGo's normal transaction workflow.

Unocoin has not established how the mechanism was accessed or whether private signing keys were compromised.

The company is also investigating possible cryptocurrency losses and the extent of any information exposure.

What Happened at Unocoin? Complete Incident Timeline

The incident developed over several days, beginning with suspicious activity detected on November 6.

November 6: Unocoin Detects Unauthorized Activity

Unocoin identified suspicious activity involving its infrastructure.

As a precaution, the exchange requested immediate freezes of enterprise accounts maintained with two digital asset service providers.

Fireblocks received the freeze request at 11:24 UTC.

BitGo received its request at 11:29 UTC.

Both providers subsequently confirmed the freezes.

At that stage, Unocoin said it had not identified any cryptocurrency losses.

November 9: Further Activity Forces Service Suspension

Despite reviewing and strengthening apparent security weaknesses, Unocoin detected additional unauthorized activity.

The company decided to suspend its services to protect customer assets and information.

Its investigation established that parts of its infrastructure had been compromised.

Rather than attempting to restore the existing environment, Unocoin began rebuilding its server infrastructure from the ground up.

The exchange initially estimated that this work would require approximately four to five working days.

That estimate was not a guaranteed reopening date.

November 12: Suspicious Ethereum Transactions Discovered

Unocoin reported identifying outgoing transactions involving an Ethereum address within its BitGo wallet infrastructure.

The address had been used to fund ERC-20 token operations.

The exchange escalated the discovery to BitGo.

However, it could not immediately reconstruct all potentially affected transactions.

Its frozen account access and wallet address structure complicated the investigation.

November 13: Multisig Backup Mechanism Comes Under Scrutiny

Unocoin said BitGo had provided the requested information and clarifications.

The exchange reported that the transactions were signed and broadcast directly on-chain, without passing through BitGo's platform.

Unocoin consequently identified possible misuse of the multisignature wallet's backup mechanism as an area of investigation.

The company has not confirmed precisely which signing credentials were used or how any unauthorized party might have obtained them.

How BitGo's Multisig Backup Mechanism Works

To understand the incident, it is necessary to distinguish a platform account freeze from the underlying authorization rules of a cryptocurrency wallet.

BitGo supports wallet architectures that use multisignature or multiparty computation technology.

In a common 2-of-3 configuration, three signing credentials are involved.

These are generally described as the user key, backup key and BitGo key.

Two authorized signing credentials are required to approve a transaction.

Normal Transaction Authorization

Under the standard signing workflow, the user key and BitGo key cooperate to authorize a transfer.

This allows BitGo to apply controls within its supported transaction process.

Those controls can include policy checks and account restrictions, depending on the wallet and service configuration.

Backup Recovery Authorization

The backup mechanism exists to provide an alternative means of accessing funds if BitGo becomes unavailable.

In a supported recovery arrangement, the user key and backup key may authorize a transaction without BitGo's participation.

This is an intentional recovery capability.

It helps reduce dependence on a single service provider.

However, it also means that the security of the backup credentials is critical.

Why a Frozen Account May Not Stop Every Transaction

A BitGo platform freeze can prevent transactions initiated through the frozen account's ordinary service workflow.

It does not necessarily invalidate cryptographic signing credentials that can independently authorize a transaction.

If an authorized combination of keys can produce a valid blockchain transaction outside the platform, the blockchain may accept that transaction regardless of the account's status within BitGo's internal systems.

This does not prove that the wallet's cryptography was broken.

It means the platform-level restriction and blockchain-level authorization are separate controls.

Unocoin BitGo Multisig Backup Exploit: What Is Confirmed and What Remains Unknown?

The term exploit can suggest a software vulnerability, but the available evidence does not yet establish one.

Unocoin's statement identifies suspected misuse of the backup recovery arrangement.

It does not confirm that attackers discovered a flaw in BitGo's wallet code.

Confirmed Findings vs Unresolved Questions

The distinction matters for determining responsibility.

If attackers obtained valid signing credentials through compromised infrastructure, the security failure may differ substantially from an exploit involving defective wallet software.

Until investigators establish the mechanism, assigning a definitive technical cause would be premature.

Did BitGo's Account Freeze Fail?

Based on Unocoin's November 13 update, the account freeze appears to have functioned as intended.

The exchange said the disputed transactions did not pass through BitGo's platform.

That means they may not have been subject to the restrictions applied to the enterprise account.

Platform-Level Controls vs Blockchain-Level Controls

The layers are related, but they are not identical.

An account freeze is not the same as disabling every possible combination of wallet signing credentials.

Why This Matters for Institutional Custody

Institutional cryptocurrency users often rely on multiple layers of security.

They may use custody providers, transaction policies, multisignature approvals and recovery procedures.

However, the overall system is only as secure as its credential management and authorization design.

A recovery mechanism intended to improve resilience can create an additional security responsibility.

That does not make recovery mechanisms inherently unsafe.

It means organizations must protect recovery credentials with the same seriousness as their primary signing systems.

Were Unocoin Customer Funds Stolen?

Unocoin has not disclosed a verified cryptocurrency loss amount.

The company has stated that more than 90% of cryptocurrency held on behalf of customers is maintained in cold storage.

It has also said that no customer funds were lost.

However, its investigation into the transactions and complete asset exposure remains ongoing.

These statements should be considered together rather than treated as proof that every balance has already been independently reconciled.

What Does 90% Cold Storage Mean?

Cold storage generally involves keeping sensitive signing credentials offline or otherwise isolated from ordinary internet-connected systems.

This can reduce exposure to certain remote attacks.

However, a high cold-storage percentage does not establish that all remaining assets are safe.

The operational portion of an exchange's holdings may still be exposed to risks involving credentials, transaction approvals and connected infrastructure.

Why Unocoin Cannot Yet Confirm the Full Impact

The exchange has described difficulties reconstructing the relevant transaction activity.

Its frozen BitGo account prevents normal access to some information.

It also identified wallet address structures as an additional challenge when tracing transactions.

Unocoin has requested transaction-level details to determine the full extent of potentially unintended transfers.

Until that process is completed, the value of any loss remains uncertain.

Why the BitGo Investigation Matters for Crypto Custody

BitGo is an established digital asset custody and wallet infrastructure provider.

Its services are used by institutions that require secure ways to hold and transfer cryptocurrency.

The Unocoin incident therefore raises questions relevant to more than one exchange.

Recovery Mechanisms Create a Security Trade-Off

A recovery mechanism can help prevent permanent loss of access when a service provider becomes unavailable.

That is an important benefit.

However, recovery credentials must be securely generated, stored and accessed.

If unauthorized individuals obtain enough credentials to meet a wallet's signing threshold, they may be able to authorize transfers.

Custody Providers Cannot Control Every External Signature

Blockchain transactions are validated according to network rules.

A transaction signed with the required credentials may be accepted even if it was not submitted through the wallet provider's application.

This is one reason why custody security requires careful attention to key management.

The Importance of Independent Recovery-Key Protection

Organizations should evaluate how recovery credentials are stored and who can access them.

They should also review whether recovery procedures require independent approvals and whether those procedures are tested.

The goal is to preserve emergency access without creating an unnecessarily accessible alternative signing path.

Unocoin's Infrastructure Rebuild Adds to Operational Concerns

The exchange has decided to rebuild its server infrastructure rather than simply restore compromised systems.

This is a significant operational undertaking.

It suggests the company is taking a broad approach to reducing the possibility that unauthorized access persists.

However, rebuilding servers does not automatically resolve every potential wallet security issue.

What Must Be Investigated?

The company needs to determine how its infrastructure was compromised.

It must also establish whether attackers accessed credentials, operational systems or sensitive information.

The wallet investigation introduces additional questions about signing authorization and transaction history.

Restoring service safely will require confidence that the relevant security weaknesses have been addressed.

When Will Unocoin Resume Services?

Unocoin initially estimated four to five working days for the infrastructure rebuild.

However, the November 13 statement indicates that the investigation remains ongoing.

The exchange has not established a firm reopening date.

Service restoration should therefore not be treated as confirmed until Unocoin announces it.

Recent Crypto Security Incidents Highlight Infrastructure Risks

The Unocoin investigation follows several recent cryptocurrency security incidents involving different parts of the industry's infrastructure.

Bitnxt previously covered the Chainalysis data breach and subsequent restoration of compliance tools.

That incident involved exposure of sensitive account and authentication information.

Although unrelated to Unocoin, it illustrates how compromised access systems can create serious operational risks.

Another Bitnxt report examined the Gnosis Pay data breach affecting its legacy consumer card infrastructure.

Gnosis Pay reported that customer information had been exposed while stating that funds remained secure in the November incident.

These cases involve different technologies and circumstances.

However, they demonstrate that cryptocurrency security extends beyond blockchain consensus and smart contract vulnerabilities.

Credentials, infrastructure access and recovery procedures also require protection.

Bitnxt Take: The Unocoin Incident Exposes a Critical Gap Between Account Security and Wallet Security

At Bitnxt, we believe the most important lesson from the Unocoin incident is the distinction between freezing an account and preventing cryptocurrency from moving.

The two actions may sound equivalent to ordinary users.

Technically, they can be very different.

A Successful Account Freeze May Not Stop External Transactions

According to Unocoin's November 13 statement, BitGo's freeze worked as intended.

Yet transactions were reportedly executed outside its platform.

This suggests that the exchange's security problem may involve an authorization route beyond the controls available through the enterprise account.

We believe institutional customers should understand these distinctions before relying on any single security measure.

Backup Mechanisms Should Be Treated as High-Risk Infrastructure

Recovery systems are essential because organizations need ways to regain access to assets during emergencies.

However, a backup key is not harmless simply because it is rarely used.

It may represent an alternative means of authorizing valuable transactions.

Organizations should therefore evaluate backup-key protection, separation of duties and recovery approval procedures.

The Incident Does Not Yet Prove BitGo Was Hacked

We believe it is important not to assign responsibility before investigators establish the facts.

The current evidence does not demonstrate that attackers breached BitGo's internal systems.

It also does not establish that BitGo's multisignature technology contains a software vulnerability.

The suspected misuse of recovery credentials is a serious concern, but it is not the same as a confirmed cryptographic failure.

Cold Storage Is Reassuring but Not a Complete Answer

Unocoin's statement that more than 90% of customer cryptocurrency is held in cold storage provides useful context.

However, customers still need clarity about the remaining operational holdings and any affected transactions.

We believe the exchange should publish a verified accounting of the incident once its investigation is complete.

That would help distinguish potentially unauthorized transfers from confirmed financial losses.

Our Assessment

Bitnxt believes the Unocoin case demonstrates that cryptocurrency custody security must cover every authorized signing route, including emergency recovery procedures, rather than relying solely on platform freezes and ordinary transaction controls.

The investigation may ultimately reveal a credential compromise, an operational failure or another mechanism.

Until that evidence is available, the correct conclusion is that the incident remains unresolved.

What Should Unocoin Users Do?

Users should rely on verified company communications for information about account access and service restoration.

The exchange has suspended services while investigating the incident.

Customers should avoid unofficial recovery services or individuals claiming they can restore access to frozen exchange accounts.

They should also remain cautious about messages requesting wallet credentials or payments.

Unocoin has not established that all customer assets were lost.

Therefore, users should not assume that their balances have disappeared simply because the exchange's services are temporarily unavailable.

The most useful next development will be a verified update explaining the affected transactions and the status of customer holdings.

What Happens Next in the Investigation?

Several questions remain unanswered.

Unocoin and its service providers need to establish the precise mechanism used to authorize the transactions.

They must also determine whether any signing credentials were compromised and how the exchange's infrastructure was initially accessed.

The financial investigation will need to identify the value and destination of potentially unauthorized transfers.

Finally, Unocoin must complete its infrastructure restoration and security validation before reopening services.

Key Developments to Monitor

Final Thoughts

Unocoin's November 13 security update has raised important questions about cryptocurrency custody and multisignature wallet recovery mechanisms.

The exchange reported that outgoing transactions were executed directly on-chain despite its BitGo enterprise account remaining frozen.

According to Unocoin, the platform-level freeze worked as intended.

The company suspects that an alternative recovery mechanism may have been used, but the precise authorization method remains under investigation.

No verified cryptocurrency loss amount has been disclosed.

Unocoin continues examining its compromised infrastructure, potentially affected transactions and customer asset exposure.

Bitnxt believes the incident highlights an essential principle of institutional crypto security: protecting a custody platform is not enough if alternative transaction-signing paths are not equally protected.

The outcome of the investigation could provide valuable lessons for exchanges, custodians and other businesses managing digital assets through multisignature infrastructure.