BitGo says Unocoin-held keys signed transfers after account freeze

BitGo said in a statement shared on X on Nov. 13 that its review found no breach of its systems and no impact on other clients. It directed questions about customer funds to Unocoin.

The wallet used a 2-of-3 signing setup: Unocoin held the user and backup keys, while BitGo held the third. Two keys are needed to authorize a transaction. BitGo’s documentation says a backup key can be paired with either of the other keys, and that self-custody clients retain their private user and backup keys.

Unocoin said it received requested information and clarifications from BitGo. The exchange suspects its wallet backup mechanism was exploited and is investigating how it was accessed, whether cryptocurrency was lost and whether private information was exposed. Neither company’s Nov. 13 statements identified who used the keys or confirmed a loss figure.

Unocoin detected the transfers on Nov. 12, after requesting freezes on accounts used for daily cryptocurrency transactions. The exchange had said suspicious activity was first detected on Nov. 6, when it requested a Fireblocks freeze at 11:24 UTC and a BitGo freeze at 11:29 UTC. Both providers confirmed the requests, according to Unocoin.

After detecting further unauthorized activity on Nov. 9, Unocoin suspended services. It said its infrastructure had been compromised and that the systems accessed and any information exposed were still under review. More than 90% of customer cryptocurrency was held in cold storage, the exchange said. It estimated that rebuilding and securing its servers would take four to five working days, followed by security checks before services resumed.