BTC $68,063 
EQQQQ $655.75 Last updated 8 Nov 2026, 12:03 UTC
ETH $1,919 
MGLOEURO $111,813 
USDT $0.9990 
BNB $628.00 
USDC $0.9994 
XRP $1.01 
SOL $78.09 
TRX $0.3122 Exchanges · Explained
Unocoin keeps services halted while investigating BitGo wallet transfers
The Indian exchange suspects a wallet recovery feature was misused to authorize transactions outside BitGo's platform.
Key takeaways
- Recovery mechanisms create custody risks. BitGo's wallet recovery feature, designed as a backup if the custodian is unavailable, may have provided an alternative pathway for unauthorized transactions despite the account being frozen.
- Investigation ongoing with frozen access. Unocoin cannot directly access its frozen BitGo accounts to verify the full scope of transfers, complicating efforts to determine which assets were affected.
- Server infrastructure being rebuilt. The exchange determined its infrastructure was compromised and is rebuilding systems rather than restoring potentially breached environments, a process expected to take several days.
What happened
Indian cryptocurrency exchange Unocoin has kept deposits and withdrawals suspended since November 9 as it investigates unauthorized activity involving wallets held with custodian BitGo. The exchange first detected suspicious transfers on November 6 and requested that BitGo freeze its enterprise account, which the custodian confirmed occurred as intended. Despite the freeze, further unauthorized activity was discovered days later, prompting Unocoin to halt all services.
According to reports from Cointelegraph and Bitcoinist, Unocoin identified outgoing transactions from an Ethereum address within its BitGo wallet infrastructure on November 12. The exchange said these transactions were signed and broadcast outside BitGo's platform, and suspects that BitGo's wallet recovery feature may have been misused. This feature allows wallet holders to access funds if BitGo becomes unavailable, potentially explaining how transfers occurred even after the account was frozen.
Unocoin's investigation revealed that its own server infrastructure had been compromised. Rather than attempt to restore the affected systems, the exchange decided to rebuild its entire infrastructure, a process it estimated would take approximately four to five working days as of its November 12 update. The company has not provided a timeline for restoring customer access to deposits and withdrawals.
Why it matters
The incident highlights vulnerabilities in cryptocurrency custody arrangements that go beyond standard platform controls. While multisignature wallets and custodian freezes are designed to protect digital assets, backup mechanisms intended as safety measures can become security liabilities if compromised. For Unocoin customers, the suspension has locked their ability to move funds while the exchange and BitGo work to determine the extent of unauthorized activity and whether customer assets were actually lost. The situation also raises questions about the transparency of recovery procedures in custody infrastructure and how exchanges communicate about security breaches to their users.
Background
BitGo is a major cryptocurrency custodian that provides enterprise-grade wallet infrastructure and digital asset management services. Its multisignature wallets require multiple approvals before transactions can be completed, and it offers freeze capabilities that allow clients to immediately restrict account access during security incidents. BitGo and other custodians are used by exchanges to store a portion of customer cryptocurrency holdings, though Unocoin noted that more than 90 percent of the cryptocurrency it holds on behalf of customers is maintained in cold storage, meaning assets are kept in offline wallets not connected to internet-facing infrastructure.
Unocoin is one of India's established cryptocurrency exchanges. The incident came shortly after India's cybersecurity agency issued a November 5 warning describing an AI-assisted campaign targeting crypto exchanges and other financial institutions, though no connection between that warning and Unocoin's incident has been established. Unocoin and BitGo did not respond to requests for additional information from Cointelegraph before its report.
What is still unclear
Unocoin has not established precisely how the wallet recovery feature was accessed or who authorized the suspicious transactions. The exchange's frozen BitGo accounts limit its ability to verify the complete transaction history, and BitGo's use of change addresses complicates analysis of transaction flows visible on public blockchains. Unocoin has requested transaction-level information from BitGo but has not provided assurances about customer holdings until the investigation produces verified results. The full scope of cryptocurrency affected by the suspicious transfers, if any, remains unclear.
What to watch
Monitor announcements from Unocoin regarding the completion of its infrastructure rebuild and the resumption of deposit and withdrawal services. The exchange's investigation into the scope of unauthorized transfers and any asset losses will be a key factor in how the incident affects user confidence. Additionally, watch for any statements from BitGo clarifying how its recovery mechanism is secured and what steps it is taking to prevent similar misuse across its other enterprise customers.
Questions readers ask
Are customer assets definitely lost?
Unocoin has not confirmed that any customer cryptocurrency was lost. The company emphasized that over 90 percent of customer holdings are in cold storage. Its frozen BitGo accounts and limited visibility into transaction flows have prevented full verification of the impact.
How did the transfers happen if BitGo froze the account?
Unocoin believes the transactions were authorized through BitGo's wallet recovery feature, which allows access to funds outside the platform's standard controls if BitGo becomes unavailable. This suggests the recovery mechanism was compromised.
When will services resume?
Unocoin has not announced a specific date. The exchange estimated its infrastructure rebuild would take four to five working days as of November 12, but completion depends on investigation findings and verification of systems.
