Unocoin, the Indian cryptocurrency exchange, is examining whether a backup recovery function built into BitGo's multisignature wallets was used to move assets out of its custody setup, even though the custodian's freeze on its enterprise account held. The exchange has not said how much, if anything, was taken, and it has set no date for reopening deposits, withdrawals or trading.
The disclosure, published on November 13, marks a shift in the investigation. Unocoin first flagged suspicious activity on November 6 and asked two custody providers to lock its accounts immediately. The Fireblocks request went out at 11:24 UTC, the BitGo request five minutes later. Both firms confirmed the freezes, and the exchange said its initial review found no missing funds.
What followed complicated that picture. On November 12, Unocoin identified outgoing transfers from an Ethereum address inside its BitGo wallet infrastructure, an address that had been used to fund ERC-20 token operations. After further information from BitGo, the exchange concluded the transactions had been signed and broadcast directly on-chain rather than routed through the custodian's platform. In its update, Unocoin said BitGo confirmed the account freeze "worked as intended."
That distinction points investigators toward a recovery mechanism that lets wallet holders reach their assets if BitGo itself becomes unavailable. Unocoin said the feature "appears to have been exploited," while adding that it has not established how the transfers were authorized, whether private keys were compromised, or what the financial toll might be.
BitGo's own documentation describes a Wallet Recovery Wizard that lets clients move assets "without BitGo," using the user key and backup key to sweep funds to a new address. Those recovery transactions, the documents state, "bypass any policies you have with BitGo." Operating the tool requires the backup public key, the user public key, the wallet passphrase and either the BitGo public key or the wallet address. The exchange has not identified who held the key in question.
Nothing disclosed so far establishes that BitGo's platform was breached or that its custody software contains a vulnerability. BitGo, which trades on the New York Stock Exchange under the ticker BTGO, recently reported third-quarter net income of $44.1 million, helped by a $71.5 million unrealized gain on its digital asset treasury.
Separately, Unocoin is rebuilding its server infrastructure from scratch after concluding that its own systems had been compromised. It estimated on November 12 that the work would take roughly four to five working days, followed by security checks, though it cautioned that the estimate is not a reopening date. The exchange has not published a full transaction history, affected wallet balances or a verified loss estimate. It has said more than 90% of customer crypto sits in cold storage, a figure that describes asset allocation rather than a reconciliation of liabilities against holdings.
Visibility into the wallets has been a running problem. Unocoin said its frozen BitGo accounts cut off access to complete transaction records, and the use of change addresses inside the wallet structure made it hard to reconstruct activity from public blockchain data alone. A November 12 report said roughly 81,000 addresses attributed to Unocoin showed zero portfolio value on Arkham Intelligence, though such labels do not necessarily capture an exchange's full custody holdings and the same report noted the tagged wallets had held only modest sums.
A warning issued November 5 by India's cybersecurity agency described an AI-assisted campaign aimed at crypto exchanges and other financial firms. No link between that campaign and Unocoin's case has been established.
The episode echoes earlier custody disputes in the sector. WazirX and its custody partner Liminal spent months assigning blame after a $234 million hack in July 2024, with Liminal saying transactions originated on its client's side and WazirX pointing to a fault in the Liminal platform. In September, researchers examining Bitget's $387.5 million breach described manipulation of its transaction-signing process. In October, Indian exchange CoinDCX disclosed a $15.99 million USDT loss after an automated wallet-sweeping failure left deposits in previously compromised infrastructure. Neither case has a known connection to Unocoin, and their technical causes should not be treated as equivalent.
For customers, the practical situation is unchanged: deposits and withdrawals remain paused with no return date. For the wider market, the case draws a line between blocking access to a custody platform and blocking transactions that can be signed outside it. If external signing credentials stay usable, an account-level freeze may not be enough to stop unauthorized blockchain transfers.
Unocoin's path back depends on more than new servers. It must explain how the transfers were authorized, determine whether customer assets or data were exposed, and show that its custody arrangements can operate safely before it restores service. Until a verified reconciliation appears, neither the cold-storage percentage nor on-chain wallet balances settles the question of whether a shortfall exists behind customer claims.
