Unocoin claims over 90% of assets in cold storage amid ongoing investigation

BitGo says it was not the weak link in Unocoin’s security incident. The custody provider reports that the Indian crypto exchange signed a set of Ethereum transactions using its own user and backup keys, and BitGo’s key was never used.

That clarification shifts the investigation away from the custodian and back toward the exchange. Unocoin has suspended all services, including user logins, while it works out what went wrong.

A week of freezes, shutdowns and flagged transfers

The trouble began on November 6, 2026, when Unocoin detected unauthorized activity on its platform. It moved quickly to lock things down.

The exchange asked Fireblocks to freeze its enterprise accounts at 11:24 UTC. Five minutes later, at 11:29 UTC, it sent the same request to BitGo. Both freezes were confirmed shortly after the requests came in.

The freezes did not end the episode. On November 9, further unauthorized actions pushed Unocoin to shut down every service on the platform, logins included.

The exchange began investigating a potential compromise of its servers. It also said it planned to rebuild its systems from scratch, a job it estimated would take 4-5 working days.

Then came another twist. On November 12, Unocoin spotted some outgoing Ethereum transactions from its BitGo wallet infrastructure. It escalated those transfers for review.

How a 2-of-3 wallet works, and why BitGo is pointing at the keys

To understand BitGo’s response, it helps to know how the wallet is set up. Unocoin used a 2-of-3 multisig arrangement. In this setup, the three keys are a user key, a backup key and BitGo’s key. Any two signatures are enough to approve a transaction.

That is the crux of BitGo’s finding. Its investigation, completed on November 13, concluded that its systems had not been breached. The Ethereum transactions, BitGo said, were authorized using Unocoin’s own private keys: the user key and the backup key, without BitGo’s key ever being involved.

The research findings indicate this points to a possible exploitation of the backup key mechanism within Unocoin’s multisig setup. That remains a working theory rather than a confirmed explanation, and the investigation is still underway.

BitGo also said no other clients were affected by the incident.

Where Unocoin’s customers stand

Unocoin’s position is that the damage is contained. The exchange says it keeps over 90% of customer assets in cold storage, meaning offline wallets that are not connected to the internet.

It also says there have been no confirmed losses so far. That claim sits alongside a less comforting admission: Unocoin says it does not yet have full visibility into every transaction.

The exchange attributes that gap to the complexity of change addresses. These are addresses that receive leftover funds from a transaction, and they can make tracing the full path of money more complicated than following a single transfer.

Meanwhile, customers cannot log in at all until the rebuild is finished.

What this means for exchanges and custody providers

If two of the three keys sit under the same organization’s control, the safeguard depends heavily on how carefully that organization protects them. A compromised server holding or accessing both keys could, in theory, approve transactions without the custodian’s involvement. The investigation will determine whether that is what happened here.

The bigger question for traders is how exchanges design the backup key piece of their custody arrangements. If the investigation confirms that mechanism was exploited, other platforms running similar 2-of-3 setups may revisit where their backup keys live and who can reach them.

If Unocoin’s claim of keeping over 90% of customer assets in cold storage holds up, the bulk of user funds sat outside the hot infrastructure that appears to have been targeted.

Until Unocoin can account for every outgoing transaction, including those routed through change addresses, “no confirmed losses” remains a statement about what has been verified so far, not a final tally.