BitGo Denies Breach as Unocoin Probes Wallet Transfers

BitGo said its systems were not breached in the Unocoin security incident and that disputed outgoing transfers were signed with two keys held by the Indian cryptocurrency exchange, whose services remain suspended.

In a Nov. 13 statement, BitGo said Unocoin used a self-custody wallet arrangement requiring two of three signing keys. Unocoin held the user and backup keys; BitGo held the third. Its review found that the transfers were signed with the two Unocoin-held keys and broadcast directly onchain, without BitGo's participation.

“BitGo’s key was never used,” the company said. It said no other clients were affected and directed questions about customer funds to Unocoin.

Unocoin acknowledged in its Nov. 13 incident update that the transactions were signed and broadcast outside BitGo's platform. It said a backup mechanism designed to preserve access to funds if BitGo became unavailable appeared to have been exploited. The exchange said it was investigating the mechanism, cryptocurrency losses and information privacy.

What the Nov. 6 Freeze Covered

Unocoin said it first detected suspicious activity on Nov. 6 and requested freezes of its enterprise accounts at BitGo and Fireblocks, which held balances for day-to-day transactions. Both providers confirmed that no further transactions could be initiated through their platforms, according to the exchange. BitGo said its Nov. 6 freeze “functioned as intended.”

The exchange said it discovered outgoing transactions from an Ethereum address in its BitGo wallet infrastructure on Nov. 12. That was the discovery date; neither company's statement specified the transfers' execution times.

BitGo's wallet documentation says normal transactions use the user key and BitGo key, but the backup key can be paired with either of the other two. Its recovery instructions describe signing and broadcasting transactions without using BitGo services.

In that setup, freezing access to BitGo's platform does not remove the client's separate ability to sign with its two keys. That distinction explains how transfers can occur without BitGo's participation; it does not establish who used the keys or responsibility for any loss.

Customer Funds Remain Under Review

Unocoin disclosed unauthorized server access on Nov. 9, disabled customer logins and said no crypto funds had been lost. Its subsequent incident notice said it suspended all services after detecting further unauthorized activity that day and established that its infrastructure had been compromised.

The exchange continued to tell users on Nov. 13 that “No user funds have been lost, and your assets remain safe.” Its incident notice, however, said it was still investigating cryptocurrency losses and establishing the status of its holdings. It said more than 90% of customer cryptocurrency was held in cold storage. The notice gave no confirmed loss figure.

A Nov. 12 snapshot of Arkham's Unocoin entity page listed 80,986 attributed addresses with “no priced token holdings.” That snapshot alone does not establish a theft, when balances changed or whether Unocoin holds assets outside that address set. The address count is not a count of affected customers.

On Nov. 13, Unocoin's website displayed a maintenance notice. The exchange estimated rebuilding its server infrastructure would take four to five working days, with security checks required before services resumed. It said withdrawals would resume and pending requests would be processed once services were restored, without giving a fixed reopening date.

Update, Nov. 13, 2026: Added BitGo's findings, Unocoin's acknowledgment of externally signed transfers, the account-freeze timeline and updated service and customer-fund statements.