BitGo: Unocoin’s Own Backup Keys Signed Suspicious Transfers
In this article
BitGo said the suspicious outgoing transactions tied to Indian exchange Unocoin were signed with two keys held by the exchange itself and broadcast on-chain without the custodian’s involvement, according to a Nov. 13 statement the company shared on X. Unocoin’s enterprise account had been frozen at the exchange’s own request on Nov. 6, and BitGo said the freeze operated as intended. The dispute, first detailed by Bitcoinist, has kept deposits and withdrawals suspended while investigators try to establish how the transfers were authorized.
Two accounts of the same transfer
Unocoin’s Nov. 13 update described a recovery mechanism in BitGo’s multisignature infrastructure that lets wallet holders reach their assets if the custodian becomes unavailable. The exchange said it suspects the feature was misused and is investigating how it was accessed and whether any cryptocurrency was lost.
BitGo’s account, reported by crypto.news, offers a narrower explanation. The custodian said the transfers were completed with the user key and backup key that Unocoin holds, then broadcast directly on-chain. Normal transactions use the user key plus BitGo’s key, but the backup key can pair with either of the other two to meet the two-signature threshold.
The two statements overlap but differ in emphasis. BitGo frames the incident as activity executed outside its platform with keys it does not hold; Unocoin frames the same activity as a suspected exploitation of a designed backup path. Neither account names who used the keys or gives a confirmed loss figure.
The exchange has said its full transaction history is difficult to reconstruct through public blockchain data partly because of BitGo’s use of change addresses. It has requested transaction-level information from the custodian and says it has now received the clarifications it sought.
India’s crypto tax and reporting backdrop
For Indian users, the immediate question is whether the pause affects their tax position. Crypto gains in India are taxed at a flat 30% under Section 115BBH, with 1% TDS on transfers under Section 194S; losses cannot be set off against other income or carried forward. Exchanges serving Indians must be registered with FIU-IND as reporting entities, and 18% GST applies to exchange service fees. Any freeze or delayed withdrawal does not by itself change a user’s tax liability, though record-keeping becomes more important when transaction histories are disputed.
Security lessons from a backup path
Multisignature wallets are designed to require more than one approval before funds move. The Unocoin episode shows that the recovery route around those approvals is itself a security surface. Cointelegraph reported that a Nov. 5 warning from India’s cybersecurity agency described an AI-assisted campaign targeting crypto exchanges and financial firms, though no link to Unocoin’s incident has been established.
Market snapshot
At the time the incident update was published, Ethereum (ETH) traded at $1,891 (₹178,268), down 1.3% over 24 hours and 15.8% over seven days, with a market cap of $231.13 billion and $9.11 billion in 24-hour volume, according to CoinPaprika data timestamps 14 Nov 2026, 04:36 UTC. USDT in India traded at ₹94.22 against a reference rate of ₹94.29, a slight negative premium.
Why it matters
Custody arrangements are only as strong as their weakest recovery path. If a backup key held by a client can complete a transaction without the custodian, then freezing the custodian account does not stop a determined attacker who has reached the client’s infrastructure. That is the scenario now under review, and it applies to any exchange using similar self-custody designs. For readers tracking fast-deposit platforms and exchange reliability, the case is a reminder that withdrawal speed and wallet architecture should be judged together.
What to watch
Unocoin has not set a date for restoring services, and its stated rebuild window of four to five working days from Nov. 12 is the nearest checkpoint. The next material disclosures are the exchange’s verification of transaction-level data from BitGo and any confirmed figure on affected funds.
Frequently Asked Questions
Did BitGo suffer a security breach in the Unocoin incident?
BitGo stated on Nov. 13 that its systems were not breached, that Unocoin’s account freeze worked as intended, and that its own signing key was not used in the transfers under review.
How many keys did Unocoin control in its BitGo wallet?
According to BitGo, the wallet used a 2-of-3 setup in which Unocoin held the user and backup keys while BitGo held the third. Two keys are needed to authorize a transaction.
Has Unocoin confirmed any customer loss?
No. Unocoin has said it has not yet produced a definitive assessment of funds potentially affected and will not give assurances until transaction-level information is verified.
When will Unocoin restore services?
Unocoin has not announced a restoration date. It estimated on Nov. 12 that rebuilding its server infrastructure would take roughly four to five working days.
Sources: Bitcoinist, crypto.news, Cointelegraph
