Unocoin Says Funds Left a BitGo Wallet Frozen Since November 6

Funds Moved Despite a BitGo Freeze

Unocoin confirmed on Friday that funds left one of its wallets even though BitGo had frozen the account, the sharpest update yet in the security incident the Indian exchange has been tracing since November 6. In a statement posted on X, the company said the money was moved out of a wallet that BitGo had confirmed frozen, and that a backup recovery path inside BitGo's multisignature wallets appears to have been exploited. BitGo, which trades on the NYSE as BTGO, has not publicly disputed that account. Unocoin has not named who controlled the key, and it has not stated how much crypto was taken.

@Unocoin · X post

A statement posted on X.

View on X

The timeline matters. Unocoin spotted suspicious activity on November 6 and asked both of its custodians to freeze its corporate accounts; the freezes took effect at 11:24 UTC for Fireblocks and 11:29 UTC for BitGo, and neither custodian found losses at that point. Multisignature wallets of this type carry a recovery route meant to let a client reach funds if the custodian goes offline. BitGo's own Wallet Recovery Wizard documentation describes moving assets “without BitGo” using the user's private key and the backup key, and states that such recovery transactions bypass any policies agreed with BitGo. The wizard requires the backup public key, the user public key, the wallet passphrase and either the BitGo public key or the wallet address, and the resulting transaction sends the assets to a new address. Unocoin says this path “appears to have been exploited” and is now checking how it was reached and used. The company has confirmed that more than 90% of customer crypto sits in cold storage.

Suspensions, Server Rebuild and On-Chain Traces

Operations remain halted. Unocoin first detected the unauthorized activity on November 6, suspended all services on Monday, November 9, after spotting further movement, and by Thursday had disclosed outgoing transactions from an Ethereum address in its BitGo wallet infrastructure. Its servers, the company said, had been compromised. It reported that the same address had been used to fund ERC-20 tokens, and that the transactions under investigation were signed and broadcast outside BitGo's platform. Unocoin suspects the recovery feature was misused, but it has yet to establish how the transfers were carried out or whether any digital assets are missing. It blames BitGo's change-address setup for making the full transaction history hard to reconstruct, and says it is rebuilding its entire server stack, a task it expects to take four to five working days. No date for restoring deposits and withdrawals has been announced.

On-chain data labeled roughly 80,986 Unocoin-linked addresses with a total value of zero as of November 12. The same reading shows those labeled wallets held at most a few hundred dollars over the past month, with a three-month peak just over $250,000, so the cluster captures only a small slice of the exchange's footprint. India's cybersecurity agency had warned on November 5 of an AI-assisted campaign targeting crypto exchanges and other financial firms, although no connection to this incident has been established. BitGo separately reported third-quarter net income of $44.1 million, driven by a $71.5 million unrealized gain on its digital asset treasury. The recovery wizard at the center of the case is one of several wallet recovery routes that move assets without a custodian's sign-off.

The incident reads as a failure of a feature, not a breach of the freeze itself: the funds left through a path BitGo documents openly, which means the security perimeter now depends on how well a client protects a backup key held outside the custodian's control. That ambiguity sets up the same accountability fight the sector saw after the $234 million WazirX hack in July 2024, when WazirX and its custody partner Liminal spent months blaming each other. Until Unocoin publishes a loss figure and names the holder of the key, the Ethereum address used to fund ERC-20 tokens remains the only on-chain evidence of where the money went.