CryptoSlate
Unocoin said on Nov. 13 that disputed wallet transfers were signed and broadcast outside BitGo, even as the freeze on its BitGo enterprise account had held. The exchange suspended all services on Nov. 9 after detecting further unauthorized activity, having requested freezes on its enterprise accounts at BitGo and Fireblocks following the initial detection on Nov. 6. On Nov. 12 it identified outgoing transactions from an Ethereum address within its BitGo wallet infrastructure used to fund ERC-20 tokens.
The exchange suspects its backup mechanism, designed to preserve access to funds if BitGo became unavailable, was exploited. It is still investigating how that mechanism was used, the size of the cryptocurrency losses, and potential exposure of customer information.
Why it matters
BitGo wallets use a two-of-three key structure: the user key, backup key, and BitGo key. Normal transactions pair the user and BitGo keys, but the backup key can pair with the user key instead, producing a recovery signing route that never involves BitGo. The provider's own documentation notes that withdrawal policies apply only to transactions involving BitGo, so recovery transactions bypass every policy configured with the provider.
That structural detail is the story. An account freeze at the custodian is not a blanket restriction on everything the wallet's keys can sign, and any holder of a user and backup key pair can move funds without the provider ever seeing the transaction.
Market impact
Unocoin reported in its Nov. 12 update that more than 90% of customer cryptocurrency funds were held in cold storage, but it had not finished establishing the full status of holdings, so the loss assessment remains open. Unresolved questions include how the suspected recovery path was accessed, what losses or information exposure resulted, and when suspended services can resume. Custody arrangements across the industry will now be re-examined for the same recovery-key gap.
Frequently asked questions
-
How did hackers bypass the freeze on Unocoin's BitGo account?
BitGo wallets use a two-of-three key system. By pairing the backup key with the user key, transactions can be signed without BitGo's key, and withdrawal policies apply only to transactions involving BitGo, so recovery transfers skip them entirely.
-
When did Unocoin suspend its services?
Unocoin suspended all services on Nov. 9 after detecting further unauthorized activity, having requested freezes on its enterprise accounts at BitGo and Fireblocks following the initial detection on Nov. 6.
-
How much cryptocurrency did Unocoin lose in the incident?
The total is not yet confirmed. Unocoin identified outgoing transactions on Nov. 12 from an Ethereum address in its BitGo infrastructure and is still investigating the cryptocurrency losses and potential information exposure.
-
Are Unocoin customer funds safe?
Unocoin said more than 90% of customer cryptocurrency funds were maintained in cold storage in its Nov. 12 update, but it had not finished establishing the complete status of holdings, so overall exposure remains unresolved.
-
What is BitGo's recovery signing mechanism?
It is a backup route designed to preserve access to funds if BitGo becomes unavailable. The backup key pairs with the user key to satisfy the two-of-three requirement, leaving BitGo outside the signing process and outside its configured withdrawal policies.
CoinTelegraph
TheBlock
WuBlockchain
Lookonchain