2026

Read

would

Ethereum

Arkham

<p>BitGo has said its systems were not breached in the Unocoin incident, with its review finding that outgoing transactions were signed using two keys held by the Indian exchange after its account was frozen on Nov. 6.</p>
<div id="cn-block-summary-block_90e2fbe523a364db1dd334b2071ed8b6" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>BitGo says Unocoin’s account freeze worked and its signing key was never used in the transfers.</li>
   <li>Unocoin held two of the three keys in its self-custody wallet setup, according to BitGo.</li>
   <li>The exchange is investigating suspected misuse of a backup mechanism while working to restore services.</li>
  </ul>
 </div>
</div>
<p>BitGo, in a Nov. 13 statement shared on X, said the transactions were signed with Unocoin’s user and backup keys and broadcast directly on-chain without its participation. The company said no other clients were affected and directed questions about customer funds to Unocoin.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>Unocoin’s account was frozen on November 6, 2026, and the freeze functioned as intended.<br><br>Our review found that the recent outgoing transactions were signed using the user and backup keys held by Unocoin and broadcast externally on-chain, without BitGo's participation.<br><br>Unocoin’s…</p>— BitGo (@BitGo) <a href="https://x.com/BitGo/status/2121244944169877788?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">November 13, 2026</a>
  </blockquote>
 </div>
</figure>
<p>The statement follows the exchange’s disclosure of outgoing transactions from an Ethereum address within its BitGo wallet infrastructure. Unocoin identified the activity on Nov. 12, several days after requesting freezes on accounts used for its daily cryptocurrency transactions.</p>
<h2 class="wp-block-heading" id="bitgo-says-unocoin-held-the-two-keys-used-to-sign">BitGo says Unocoin held the two keys used to sign</h2>
<p>According to BitGo, Unocoin’s wallets use a 2-of-3 self-custody arrangement. Unocoin holds the user key and backup key, while BitGo holds the third. Two keys are needed to authorize a transaction, and the company said its own key was never used in the transfers under review.</p>
<p>BitGo’s <a href="https://developers.bitgo.com/docs/wallets-overview" rel="noopener noreferrer nofollow">wallet documentation</a> describes the same signing structure. Normal transactions use the user key and BitGo key, but a backup key can be combined with either of the other two keys to complete the required signatures.</p>
<p>You might also like: <a href="https://crypto.news/bitgo-stock-rises-q3-2026-revenue-profit/" rel="noopener noreferrer nofollow"> BitGo stock rises 5% as Q3 profit jumps 94% despite revenue slump </a></p>
<p>For self-custody wallets, the documentation says BitGo does not have access to the private user or backup keys. Clients create their keys on their own side and provide an encrypted user key and public backup key to the platform.</p>
<p>Its separate <a href="https://github.com/BitGo/wallet-recovery-wizard/blob/master/NON_BITGO_RECOVERY.md" rel="noopener noreferrer nofollow">recovery instructions</a> describe how funds can be recovered without using BitGo services. The process creates a fully signed transaction that can then be broadcast through a blockchain explorer. Ethereum and ERC-20 token recoveries are covered in the guide.</p>
<p>The instructions list the encrypted user key, backup key, wallet passphrase and destination address among the recovery inputs. For Ethereum, users must supply the wallet contract address, with a separate token contract address required for ERC-20 assets.</p>
<h2 class="wp-block-heading" id="unocoin-suspects-the-wallet-backup-mechanism-was-exploited">Unocoin suspects the wallet backup mechanism was exploited</h2>
<p>In its <a href="https://blog.unocoin.com/security-incident-update/" rel="noopener noreferrer nofollow">updated incident notice</a>, Unocoin said on Nov. 13 that it had received the information and clarifications requested from BitGo. The exchange acknowledged that the freeze appeared to have worked and that the transactions were signed and broadcast outside the provider’s platform.</p>
<p>Unocoin said the wallet design preserves access to cryptocurrency if BitGo becomes unavailable. It suspects this backup mechanism was exploited and is investigating how it was accessed, any cryptocurrency loss, and possible exposure of private information.</p>
<p>The exchange’s account of the investigation has developed since its initial disclosure. On Nov. 12, it said frozen account access prevented it from reviewing the complete transaction history through BitGo. It had requested transaction-level information after identifying transfers from an ETH address used to fund ERC-20 tokens.</p>
<p>Neither the supplied BitGo statement nor Unocoin’s Nov. 13 clarification names the person who used the keys or gives a confirmed loss figure.</p>
<h2 class="wp-block-heading" id="earlier-disclosures-described-server-access-and-service-disruption">Earlier disclosures described server access and service disruption</h2>
<p>As crypto.news previously reported, Unocoin had <a href="https://crypto.news/unocoin-hacked-website-remains-down-as-81000-wallets-show-zero-holdings/" rel="noopener noreferrer nofollow">disabled customer logins</a> following unauthorized server access disclosed on Nov. 9. Its website was returning a 504 Gateway Time-out error on Nov. 12.</p>
<p>That coverage cited Onchain Lens, which said Arkham Intelligence displayed zero holdings across roughly 81,000 addresses associated with the exchange. Unocoin had maintained that no customer funds were lost when it first announced the login suspension.</p>
<p>In its subsequent security notice, the exchange said suspicious activity was first detected on Nov. 6. It requested a Fireblocks account freeze at 11:24 UTC and a BitGo freeze at 11:29 UTC, receiving confirmation from both providers.</p>
<p>After detecting further unauthorized activity on Nov. 9, Unocoin suspended all services. Its investigation established that its infrastructure had been compromised, according to the exchange, while the systems accessed and information potentially exposed remained under review.</p>
<p>Unocoin said more than 90% of customer cryptocurrency was held in cold storage. It estimated that rebuilding and securing its server infrastructure would take four to five working days, with security checks and validation required before services resumed.</p>
<p>Read more: <a href="https://crypto.news/bitcoin-coinbase-premium-negative-51-days/" rel="noopener noreferrer nofollow"> Bitcoin Coinbase premium stays negative for 51 days as US demand lags </a></p>

BitGo denies breach as Unocoin transfers used 2 client-held keys

Table of Contents

crypto.news

Other articles published on Nov 13, 2026

Join our free newsletter for daily crypto updates!