Unocoin Says Backup Keys Signed Transfers Outside BitGo

Indian cryptocurrency exchange Unocoin says the transfers now under review were signed and broadcast on-chain outside BitGo’s platform, and that a backup mechanism in the wallet setup appears to have been exploited. In an update dated 13 November 2026, added to a 12 November incident post, the company said BitGo had frozen the Unocoin enterprise “as per our instructions on 6th November 2026, and it is so far found that the freeze has functioned as intended.” It added: “Technically, transactions in question have got signed and broadcasted externally on-chain directly without BitGo’s platform or involvement.”

BitGo, in a post about the incident that is undated on the page itself but whose metadata records 13 November 2026, reached the same point by a more detailed route. It said the transfers involved ERC-20 tokens on Ethereum, XRP on the XRP Ledger, HBAR on Hedera and EOS, and that a detailed signing analysis focused on the affected Ethereum wallet. “The Ethereum transactions were signed using Unocoin’s user and backup keys and broadcast directly to the blockchain outside of BitGo’s platform,” it wrote. “BitGo’s key was not used in any of the reviewed Ethereum transactions.” Neither company has published a loss figure, and this article does not invent one.

What the keys were for, and what a freeze can and cannot stop

BitGo describes the affected wallet as a two-of-three multisignature, self-custody arrangement: any two of three keys could authorise a transfer, Unocoin held the user and backup keys, and BitGo held the third. Ordinary withdrawals through BitGo, it says, use the user key and BitGo’s key, with the platform’s checks applied before BitGo signs. The user and backup keys together also let the customer move funds independently, which BitGo calls an intentional feature of self-custody. “In any self-custody arrangement, the backup key must be protected and stored separately from day-to-day signing systems,” it wrote.

That is why the enterprise freeze did not, on BitGo’s account, prevent every movement. Unocoin asked BitGo and Fireblocks to freeze its enterprise accounts on 6 November, at 11:29 UTC and 11:24 UTC respectively, after detecting unauthorised activity that day. BitGo says an enterprise freeze is an instruction that it will no longer sign transactions for the wallet, and that transaction-building requests submitted through its platform on 9 November “were blocked by the enterprise freeze.” It also says a freeze “does not lock funds at the blockchain level.” Someone able to use both the user and backup keys can still meet the two-key rule and submit a transaction independently. BitGo has advised Unocoin to move remaining funds to new wallets backed by newly generated keys.

Unocoin’s 13 November update puts the same idea in its own words: BitGo multi-signature wallets, it says, “get created in such a way that we can still access crypto funds if BitGo ever disappear. Such a backup mechanism seems to be exploited and we investigate this further to understand the mechanism, loss of cryptocurrency and information privacy.” The investigation, on that wording, is still open on both the mechanism and whether cryptocurrency or personal information was lost. No total has been published.

How the incident unfolded, and what is still unknown

The 12 November post, which the later update sits on, sets out the earlier timeline. Unocoin says it detected unauthorised activity on 6 November, requested the freezes the same morning, and received confirmation from both BitGo and Fireblocks. At that point, it said, “no loss of cryptocurrency funds had been identified.” That was a statement about the moment of the first measures, not a later finding that nothing moved.

Further unauthorised activity was detected on 9 November, after which Unocoin suspended all of its services. “Our investigation subsequently established that our infrastructure had been compromised,” it wrote. The extent of that compromise, including systems accessed and information that may have been exposed, was still being investigated. As a precaution the company said it would rebuild its server infrastructure from the ground up, a job it then estimated at “approximately 4–5 working days.” The exact root cause, it said, had not yet been established.

On 12 November, Unocoin said it had found outgoing transactions from one of the ETH addresses in its BitGo wallet infrastructure, used to fund ERC-20 tokens, and had escalated that finding to BitGo. It also said it did not then have complete visibility across the wallets, because the enterprise accounts remained frozen, it could not log in to them, and change addresses in BitGo’s architecture made a full on-chain check difficult. BitGo says it has since shared findings and transaction reports with Unocoin, and that public records include a 9 November multisig transaction and a token transfer from the affected wallet that day. Unocoin says more than 90% of the cryptocurrency funds it holds for customers are kept in cold storage. That is the company’s description of how it stores funds, not a published loss or a recovery figure.

A platform freeze is not the same as a new set of keys

The useful distinction in these two posts is also the uncomfortable one. A custody platform can stop signing, and still leave a path open if the customer-held keys can meet the wallet’s threshold on their own. BitGo is explicit that this path is by design in a self-custody setup, and that it is only as strong as the separation and protection of the backup key. Unocoin now says that mechanism “seems to be exploited.” Until the companies publish a loss figure, or state that none will be found, the size of the event should stay unstated.

The operational advice that follows is the same one other recent incidents have ended on. BTCPay Server, after hot wallets were swept on older versions, told operators that a software fix was not enough if keys may already have been used, and that funds should be moved to a new wallet. BitGo’s advice to Unocoin — new wallets, new keys — is in that family. Other exchanges have also halted services first and filled in the figures later, as Mercado Bitcoin did after its November incident, or have had to account for old wallet infrastructure after the fact, as CoinDCX did. Those are comparisons of process, not of sums.

The next update that would change the story is a verified account of what moved, and whether customer information was exposed. Until Unocoin or BitGo publish that, the facts on the record are narrower: which keys signed the reviewed Ethereum transfers, that they were broadcast outside BitGo’s platform, that the 6 November freeze blocked later requests through BitGo, and that both firms are still investigating.

Sources

1. Unocoin, “Security Incident Update”, 12 November 2026, with an update dated 13 November 2026.
2. BitGo, “Unocoin Security Incident: What Happened and Why Wallet Controls Matter” (page undated; metadata records 13 November 2026).

Related stories

The closest live TSN article is Mercado Bitcoin’s halt after a security incident, another exchange that stopped services first and left the full picture to later updates.

• Mercado Bitcoin Halts Deposits and Withdrawals After Attack
• BTCPay Server Says Hot Wallets Swept on 2.4.1 and Older
• CoinDCX Admits ‘Operational Losses’ From Wallets Compromised in 2025