BitGo Says Unocoin's Own Keys Signed the Transfer It Flagged

An Indian exchange has been shut to its customers since Monday, and the firm whose platform holds part of its crypto says its own systems were not the way in. Unocoin suspended all services on 9 November after detecting unauthorised activity a second time, three days after asking Fireblocks and BitGo to freeze its enterprise accounts. On Thursday it said it had found outgoing transactions from an ether address inside its BitGo wallet infrastructure, an address it used to fund ERC-20 tokens. BitGo told The Block and Cointelegraph that the transaction it examined was signed with keys Unocoin itself held. Not one account of the incident gives a figure for anything moved or lost.

What the custody provider says it found

A multi-signature wallet needs more than one key to move money, so that no single party can act alone. Unocoin's update describes a second property of its BitGo setup, which is that the exchange keeps backup keys to reach its coins if the custodian ever disappears. That is the route it suspects. "Such a backup mechanism seems to be exploited," the update says, before adding that the exact root cause has not been established. BitGo's account points the same way and draws a line around itself.

"Our review found that the transaction examined was signed using the user and backup keys held by Unocoin and broadcast externally onchain, without BitGo's participation. BitGo's systems were not breached in connection with that transaction," a BitGo spokesperson said in a statement to Cointelegraph.

The accounts do not line up

Altcoin Buzz, publishing at 12:58 UTC on Friday, says BitGo has issued no public statement on the incident. The Block had carried the spokesperson's words some eight hours earlier, and Cointelegraph added them at 12:30 UTC the same day. Those positions do not reconcile. The phrase "the freeze has functioned as intended" comes with two different speakers attached as well, given to BitGo by The Block and to Unocoin's own update by Altcoin Buzz. On whether anything was lost the split is wider. The Block reports Unocoin saying no funds were lost, Altcoin Buzz says no loss amount has been confirmed, and Unocoin's update lists loss of cryptocurrency among the matters still under investigation. We could not establish which of those readings the exchange intends.

Five days shut, with no number attached

By Friday the shutdown had run five days. Customers could not log in, deposit or withdraw, and Unocoin named no restoration date. It estimates four to five working days to rebuild its server infrastructure, a figure The Block's own subhead renders as up to five. The exchange says more than 90% of the crypto it holds for customers sits in cold storage, its own claim, repeated by three outlets from one statement. Korea's regulator built a formal route for this exact case, letting exchanges freeze withdrawals on a suspected hack. No Indian regulator appears in any account here.

The dashboards read zero, and that is all they establish

Arkham's data has about 81,000 addresses tagged to Unocoin, and their combined value read zero on 12 November. The Block carried it through an on-chain analyst's post, saying plainly that the exchange has not confirmed its tracked wallets were drained. Altcoin Buzz took it from Arkham directly and noted that no independent investigator has tied the zero balances to the breach. Tagged addresses are a dashboard's guess at ownership, not a balance sheet. Unocoin says its own view is partial too, because BitGo's change addresses limit what it can check on-chain. "We currently do not have complete visibility into all potentially unintended transactions across our BitGo wallets," its incident report said.

What is missing is specific. No amount, in any token. No root cause, and no word on whether the activity came from outside the company or inside it. No account names the key split, and Fireblocks has said nothing. Bitget's withdrawals stayed shut for weeks after a comparable freeze. Unocoin has promised findings when the investigation ends, naming its blog and X account as the only channels for them. Its chief executive has not been quoted in any account of this one.

Read also: A Stolen Owner Key Mints 5.23M WEMIX$