Unocoin Incident: The Backup Key Path a Freeze Can't Stop
Quick answer. On November 13, 2026, Unocoin said BitGo's freeze worked, but transfers from an Ethereum address were signed outside BitGo, apparently through a backup path. BitGo says Unocoin-held user and backup keys signed. Losses are unconfirmed. A provider freeze cannot stop keys you hold.
Video transcript
Unocoin says BitGo's freeze worked. Yet transfers left an Ethereum address, signed outside BitGo with keys BitGo says Unocoin held.
On November 6, Unocoin froze its BitGo account. November 9, all services suspended. November 12, outgoing transactions found from an Ethereum address. November 13, Unocoin said the freeze worked, but a backup path appeared exploited.
BitGo wallets use three keys: user, backup and BitGo. Any two can sign. In self-custody, the customer holds the user and backup keys.
BitGo says Unocoin's user and backup keys signed, and its own key was unused. A provider freeze never sees that kind of transaction.
Much is still open. These are company statements, with no independent forensic report. No amount or hashes are published, and losses are unconfirmed.
In Guardian's analysis, backup is a control plane. A key your own servers can reach falls with them. This is not a finding about Unocoin.
Inventory every backup key and passphrase. Make sure no single server or person reaches both customer-side keys. Map signing paths that bypass a freeze. Keep backups offline under quorum or HSM control. Monitor every address onchain and reconcile balances.
Read the full article for the timeline and checklist. Guardian's blockchain pentest checks whether an intruder could reach your backup keys.
What Happened
Indian crypto exchange Unocoin says outgoing transactions left an Ethereum address in its BitGo wallet infrastructure. It identified them on November 12 and has not said when they occurred. Unocoin, Unchained
Unocoin Technologies is one of 54 VDA service providers registered with FIU-India as of March 9, 2026. That is an AML reporting status, not a licence or endorsement. Government of India, Ministry of Finance, Department of Economic Affairs
In a November 13, 2026 update, Unocoin said BitGo's freeze worked as intended. The disputed transactions were signed and broadcast directly onchain, without BitGo's platform. Cointelegraph
Unocoin said a backup mechanism appeared to have been exploited. BitGo said the same day that the transactions were signed with user and backup keys held by Unocoin. BitGo, crypto.news
Unocoin has published no amount, transaction count, hash or destination address. All services remain suspended.
Timeline
Times are UTC, from Unocoin's disclosure and BitGo's November 13 statement. Unocoin, BitGo
| Date (UTC) | Event | Source |
|---|---|---|
| Nov 6, 11:24 | Fireblocks enterprise account frozen after unauthorized activity | Unocoin |
| Nov 6, 11:29 | BitGo enterprise account frozen; confirmation received | Unocoin |
| Nov 9 | Further unauthorized activity; all services suspended; infrastructure judged compromised | Unocoin |
| Nov 12 | Outgoing transactions found from an ETH address funding ERC-20 tokens | Unocoin |
| Nov 13 | Freeze worked; transactions signed and broadcast externally; backup path suspected | Unocoin |
| Nov 13 | User and backup keys held by Unocoin signed; BitGo key unused | BitGo |
Why the Freeze Did Not Stop It
Every BitGo wallet has three keys: user, backup and BitGo. Any two of them complete a signature. BitGo Developer Portal
Normal transactions pair the user key with the BitGo key.
In self-custody wallets, BitGo says it never has access to the private user or backup keys.
CoinCover, which offers third-party key backup, said Unocoin appears to have used BitGo's self-backup option rather than its recovery service. CoinCover
BitGo also publishes a recovery tool for moving funds without its services. It builds a fully signed transaction, which the holder broadcasts through a block explorer. BitGo
For Ethereum and ERC-20 tokens, the tool takes the wallet and token contract addresses, the encrypted user and backup keys, and the wallet passphrase.
That is the point of a backup: funds stay recoverable without the provider. The same design means a freeze at the provider never sees a user plus backup transaction.
Our MPC wallet provider comparison noted that BitGo recovery with the user and backup keys bypasses its policies. Unocoin's update shows that property in a live incident. Unocoin
What Is Confirmed and What Is Open
Most of the cause is still open. The table separates company statements from unknowns.
BitGo's and CoinCover's accounts are company statements; BitGo's was also reported by Cointelegraph and crypto.news. No independent forensic report is public. BitGo, CoinCover, Cointelegraph, crypto.news
The cold storage figure does not show the state of hot or warm balances, customer data or every BitGo wallet.
| Question | Status | Source |
|---|---|---|
| Was the BitGo freeze in place? | Yes; Unocoin and BitGo say it worked as intended | Unocoin, BitGo |
| Which keys signed? | User and backup keys held by Unocoin, BitGo says | BitGo |
| Were BitGo's systems breached? | BitGo says not for that transaction, and its key was not used | BitGo |
| Other BitGo clients affected? | None, BitGo says | BitGo, via crypto.news |
| How were the keys obtained? | Not established | Unocoin, Cointelegraph |
| Is it tied to the server compromise? | Not established | Unocoin |
| Amount, count, hashes, destinations | Not published | Unocoin, Cointelegraph, Unchained |
| Customer data exposed? | Under investigation | Unocoin |
| Cold storage share | Over 90% of customer crypto, per Unocoin | Unocoin, Unchained |
What It Means for Custody Teams
In a 2-of-3 self-custody wallet, the customer holds two keys. If one breach reaches both, the threshold is met without the provider. BitGo Developer Portal, crypto.news
On November 4, India's CERT-In warned of an AI-assisted campaign against financial entities, including crypto exchanges, citing stolen wallet keys. It does not name Unocoin or link the campaign to this incident. Indian Computer Emergency Response Team (CERT-In), Ministry of Electronics and Information Technology
CERT-In's advisory recommends HSM or cold custody, multisignature approvals and withdrawal anomaly monitoring.
Backup keys sign rarely, so alerts built around routine signing may never fire for them.
Our exchange incident response plan covers halts and freeze requests. Add a step for keys your provider cannot freeze.
Guardian Analysis: Backup Is a Control Plane
This section is Guardian analysis. It does not suggest Unocoin's cause matches the finding below.
We searched Guardian's public reports for the term backup with our portfolio analyzer: 2 of 321 reports matched, holding 294 findings across every severity. Both matches concern backup price checks or passkey backups, not custody backup keys. Guardian
Those counts cover whole reports, not only backup issues. They are not an exploit or loss rate.
The closest mechanism is finding I-09 in Guardian's Veranta V2 review, an Informational operational trust assumption.
There, a publisher signature was the only gate on submitted prices. An optional backup check returned early when the backup price was missing or stale.
So a compromised publisher key could sign arbitrary values, and the backup did not reliably constrain it.
Guardian recommended separating that key from operator infrastructure, protecting it with quorum signing or an HSM, and checking values independently before signing.
The shared point: a privileged key that the operator's own infrastructure can reach falls with that infrastructure. Unocoin's backup key raises the same question.
Checklist for Exchanges and Custodians
Run these checks on every provider wallet, including the ones rarely used.
If a customer-held key may be exposed, treat it as compromised. Our private key incident runbook covers moving funds and rotating signers.
Our guide to hot, warm and cold wallets covers where regulators expect backups to be stored.
- Inventory every backup key, recovery kit and passphrase, with its holder and location.
- Confirm no single server, vault or person can reach both customer-side keys.
- Map every signing path that bypasses provider policies, approvals or freezes.
- Keep backup keys offline and apart from production, under quorum or HSM control.
- Ask each provider which actions its freeze blocks, and which it cannot.
- Rehearse an emergency freeze, then test on testnet whether a backup-key transaction still goes through.
- Monitor every wallet address onchain, including change addresses, independently of the provider.
- Reconcile ledger balances to chain balances for each address after any incident.
What a Blockchain Pentest Checks
Guardian's blockchain pentest covers key management and signers: where keys and seeds live, who can read them, threshold signing, and what one stolen credential unlocks.
For this pattern, the question is whether an intruder on exchange servers can reach a backup key.
It also covers cloud and CI/CD, where an intruder would look for key material.
Frequently Asked Questions
Did Unocoin customers lose funds?
Unocoin has not said. Its disclosure says no loss of crypto funds had been identified when it requested the November 6 freezes. Its November 13 update says possible loss and information privacy remain under investigation. Unocoin
When will Unocoin resume services?
It has given no date. Unocoin chose to rebuild its entire server infrastructure, estimating four to five working days, followed by security validation before services resume. Unocoin, Unchained
Why can't Unocoin trace the transactions itself?
Unocoin says it cannot log in to its frozen BitGo enterprise accounts to check the full scope. It also says BitGo's use of change addresses stops it fully checking onchain. Unocoin, Unchained
Related reading
- bitfinex hack explained
- best mpc wallet providers
- private key compromised runbook
- crypto exchange incident response plan
- multisig vs mpc wallet
Sources
- Unocoin: Security Incident Update – Unocoin 12 NOV
- BitGo Developer Portal: Wallets Overview
- BitGo: Non BitGo Recovery Instructions
- Cointelegraph: Unocoin Withdrawals Remain Halted Amid Crypto Transfer Probe
- Unchained: Unocoin Says One of Its BitGo Addresses Sent Out Transactions It Can't Trace
- Guardian: Veranta V2 Review, finding I-09
- CoinCover: Statement on Unocoin’s BitGo Wallet Breach
- BitGo: BitGo statement on Unocoin transactions
- crypto.news: BitGo denies breach as Unocoin transfers used 2 client-held keys
- Indian Computer Emergency Response Team (CERT-In), Ministry of Electronics and Information Technology: CERT-In Advisory CIAD-2026-0058: Escalation of AI-Driven Attacks on BFSI Entities by Threat Actor CRAFTY FALCON
- Government of India, Ministry of Finance, Department of Economic Affairs: Lok Sabha answer: Regulation of Virtual Digital Assets in the Country, Annexure-I
- Outlook Money: Unocoin Detects Unauthorised Wallet Transactions After Security Breach, Suspends Services
- Guardian: Glider Protocol Review, finding L-27
- TechCrunch: Bitcoin drops 20% after $70M worth of bitcoin was stolen from Bitfinex exchange
Test the signing paths a freeze cannot reach
Guardian tests whether compromised cloud accounts, deployment pipelines or vendor access could let an attacker reach your signing systems.