Unocoin remains offline as of November 14, 2026, after a security incident compromised the Indian exchange's infrastructure. Its latest incident update says disputed wallet transfers were signed and broadcast outside BitGo, apparently through a backup mechanism. BitGo says its enterprise account freeze worked as intended.
The companies' accounts change the initial picture of attackers defeating BitGo's security: the transactions used a signing route outside the frozen service. Unocoin is investigating the apparent misuse of that route and whether cryptocurrency was lost.
Two account freezes preceded the shutdown
Unocoin first detected unauthorized activity on November 6. It requested a freeze of its Fireblocks enterprise account at 11:24 UTC and its BitGo account at 11:29 UTC. Both providers confirmed the freezes, according to the exchange.
These accounts held cryptocurrency used for day-to-day transactions. Unocoin said it had identified no cryptocurrency loss when it took those initial precautions.
Further unauthorized activity appeared on November 9, prompting Unocoin to suspend all services. The exchange subsequently established that its infrastructure had been compromised.
On November 12, Unocoin identified outgoing transactions from an Ethereum address within its BitGo wallet infrastructure that it used to fund ERC-20 tokens. It escalated the finding to BitGo.
The operational shutdown preceded the wallet discovery. Services had already stopped when Unocoin disclosed the outgoing transactions.
Backup signing operated outside the frozen service
BitGo told Cointelegraph that the transaction it examined had been signed using the user and backup keys held by Unocoin, then broadcast directly onchain without BitGo's participation. It said its systems were not breached in connection with that transaction.
Unocoin's November 13 update broadly agrees with that explanation. The exchange said the freeze appeared to have functioned as intended and that a backup mechanism designed to preserve access if BitGo became unavailable seemed to have been exploited.
BitGo's wallet documentation describes a three-key arrangement: a user key, a backup key and a BitGo key. Normal transactions use the user and BitGo keys to meet a two-of-three signing requirement. The backup key can also combine with either of the other keys.
For BitGo's self-custody wallets, the documentation says BitGo never has access to the private user or backup keys. Those keys are created on the client side.
That design gives an organization a recovery route independent of BitGo. It also means securing the provider's account interface and securing every possible signing combination are separate tasks.
An enterprise freeze can therefore stop transactions routed through BitGo while independently signed transactions remain possible. Recovery credentials belong within an exchange's incident response, alongside its normal transaction systems.
For customers comparing ways to control their own keys, the relevant question is who controls the signing material. An exchange holding user and backup keys is exercising that control on behalf of its customers.
Cold storage and server rebuilding address different risks
Unocoin says more than 90% of customer cryptocurrency is maintained in cold storage. That describes its storage allocation; the exchange is still checking the status of its holdings and possible exposure.
Its earlier investigation also encountered an access problem. Frozen BitGo accounts prevented Unocoin from logging in, while the wallet architecture's use of change addresses complicated its independent examination of the transaction history. The exchange requested transaction details from BitGo and subsequently reported receiving the necessary clarifications.
Separately, Unocoin decided to rebuild its entire server infrastructure rather than restore the existing environment. It estimated four to five working days for that exercise, with security checks before services resume.
A server rebuild addresses the compromised operating environment. Reviewing recovery access addresses the signing route described in the transfer investigation. Each task requires its own resolution.
For customers, the outage creates an immediate access problem regardless of the eventual loss assessment. Deposits and withdrawals remain suspended, according to Cointelegraph's November 13 report.
The rebuild estimate covers technical work; it is not a confirmed reopening date. Unocoin's stated restoration process includes validation before operations restart.
Overview
Unocoin suspended services after further unauthorized activity on November 9 and later identified outgoing Ethereum transactions from its BitGo wallet infrastructure. The exchange suspects misuse of a backup signing mechanism.
BitGo's account freeze and the external transfers can coexist: the freeze governed activity through its service, while the examined transaction used keys held by Unocoin. The exchange's response includes a server rebuild, a review of possible cryptocurrency losses and an investigation into potential information exposure. Services remain suspended.
