Unocoin Keeps Services Suspended After Transfers Signed Outside BitGo
Key Facts
Unocoin kept all platform services suspended in its update published on November 13, after saying transactions had moved from a single Ethereum address within its BitGo wallet infrastructure. The company said it received the requested information and clarifications from BitGo that day about the wallet activity it detected on November 12. It said the transactions in question "were signed and broadcast directly on-chain from outside the BitGo platform and without its involvement." This explanation distinguishes the freezing of institutional accounts at custodians from the execution of the transfers: Unocoin said BitGo’s freeze had worked as intended as of the update. The platform is still investigating how the activity occurred and the scope of the breach of its infrastructure and what information may have been exposed.
The timeline dates to November 6, 2026, when Unocoin detected unauthorized activity and requested a freeze of its institutional account at Fireblocks at 11:24 UTC, followed by BitGo at 11:29 UTC. The company said both freezes were confirmed and that it had not detected any losses of crypto assets when it took those initial steps. On November 9, it detected additional unauthorized activity and suspended all platform services as a precaution to protect customer assets and data. It said its infrastructure had been breached and that an investigation into the extent of the breach and the information that may have been exposed was ongoing. It then detected transactions on November 12 from a single Ethereum address in its BitGo wallet infrastructure, which was used to fund ERC-20 tokens.
Unocoin said its BitGo multisignature wallets include a backup mechanism that allows access to assets even when BitGo is unavailable. It added that this mechanism "appears to have been exploited" and that it is investigating. According to the company, signing and broadcasting transactions directly on-chain from outside the BitGo platform explains how transfers could appear despite the institutional account freeze. It said BitGo’s freeze had worked as intended as of the update, so it did not describe the transfers as having been carried out through or with the involvement of the BitGo platform. The company’s investigation is focused on how the backup mechanism was used and whether it enabled access to assets outside the frozen account management path.
Unocoin says more than 90% of the crypto funds held on behalf of its customers are in cold storage. However, the company said it cannot log in to the frozen accounts and does not have full visibility into all potential transactions. Features of BitGo’s wallet infrastructure, including the use of change addresses, also limited its ability to reconstruct the full transaction history through an independent blockchain review. These constraints explain why it is relying on the information and clarifications it received from BitGo on November 13 about the November 12 activity. The update does not include a final tally of losses or definitive confirmation of the status of every asset, as Unocoin is still verifying them with BitGo and Fireblocks.
The company said its priorities include completing the investigation to determine the root cause and sequence of events, understanding the extent of information exposure, and verifying the status of assets at BitGo and Fireblocks. It had decided to rebuild its entire server infrastructure from scratch and estimated that rebuilding and securing it would take about 4–5 business days, according to its estimate in the November 12 update. It said comprehensive security checks and verification of the infrastructure’s integrity would precede the restoration of services. Services remained suspended in the November 13 update, and the company did not set a date for restarting them. Unocoin tied the platform’s resumption to completing the checks and verification, while the investigation into the activity and asset status continues.