Unocoin Says a BitGo Multisig Backup Mechanism Was Exploited, Even Though the Freeze Worked

Published November 13, 2026, 6:25 PM PKT. Based on Unocoin's security incident update of November 13, 2026 (primary source), and reporting by TokenPost, CoinGabbar and CoinScreamer on November 13, 2026 (secondary sources). This follows MABOnChain's November 12 reporting on Unocoin's suspension of services and its November 12 finding of unauthorised transfers from a BitGo wallet.

Indian crypto exchange Unocoin said on Friday, November 13, 2026, that a backup mechanism in its BitGo multisignature wallets appears to have been exploited during its ongoing security incident, even though the freeze it requested on its BitGo enterprise account worked as intended. The update narrows the mystery that has hung over the exchange since November 6, when it first detected unauthorised activity, and it shifts the focus from the custodian's platform to the recovery path built into the wallets themselves.

The freeze worked, but the transactions bypassed BitGo

Unocoin said its team received all the information and clarifications it had requested from BitGo, and that BitGo froze the exchange's enterprise account on November 6, 2026, as instructed, at 11:29 UTC. So far, the freeze has been found to have functioned as intended, the exchange said in its update. The transactions under investigation were signed and broadcast directly on the blockchain, without BitGo's platform or involvement, according to the update. TokenPost, reporting the update on November 13, said BitGo's freeze of the corporate account appeared to be working as intended while Unocoin investigates the suspected use of a multisignature wallet backup and possible asset or information losses.

The finding matters because it rules out the simplest explanation. When Unocoin reported on November 12 that outgoing transactions had appeared from one of its BitGo wallet addresses, the open question was whether the freeze had failed. The November 13 update answers that question: the freeze held, and the money moved through a different route entirely.

The backup mechanism: a key that works when the custodian disappears

BitGo multisignature wallets are built so that a client can still reach its funds if BitGo ever disappears, Unocoin said, and such a backup mechanism seems to have been exploited. BitGo's wallets use a three-key model, a user key, a backup key and a BitGo key, according to CoinGabbar, and the backup key lets a client reach funds if the custodian is ever unavailable. Unocoin said it is investigating further to understand the mechanism, the loss of cryptocurrency and information privacy.

The exchange has not confirmed precisely which signing credentials were used or how any unauthorised party might have obtained them, and the available evidence does not yet establish a software vulnerability in BitGo's platform, CoinScreamer noted. The distinction is important for the wider custody industry: a backup path designed as a safety net for clients can itself become an attack surface if its keys are exposed.

What Unocoin still cannot establish: the amount, the method, the data

The November 13 update gives no loss figure, no root cause and no restart date. The gap traces back to the November 12 finding, when Unocoin identified outgoing transactions from one Ethereum ($ETH) address in its BitGo wallet infrastructure, an address it used to fund ERC-20 tokens. The exchange escalated that finding to BitGo the same day and said BitGo was treating the matter as a priority.

Unocoin said it still lacks complete visibility into all potentially unintended transactions across its BitGo wallets. Its BitGo enterprise accounts remain frozen, it cannot log in to them, and a significant part of BitGo's wallet architecture uses change addresses when processing transactions, which limits what the exchange can check on the blockchain. The exchange said more than 90 percent of the cryptocurrency funds held for its customers are maintained in cold storage. That figure is Unocoin's own claim, and the update includes no independent verification, CoinGabbar noted.

A week of unauthorised activity, from November 6 to November 13

The incident began on Friday, November 6, when Unocoin detected unauthorised activity and asked BitGo and Fireblocks to freeze its enterprise accounts, which hold the cryptocurrency balances used for day-to-day transactions. Fireblocks froze its account at 11:24 UTC and BitGo at 11:29 UTC, and both providers confirmed the freezes. At that point, no loss of cryptocurrency funds had been identified, Unocoin said.

On Monday, November 9, the exchange detected further unauthorised activity despite rechecking and strengthening several apparent and assumed vulnerabilities, and it suspended all services immediately. Its investigation later established that its infrastructure had been compromised. On November 12, Unocoin said it would rebuild its entire server infrastructure from the ground up rather than restore the compromised environment, estimating the work at four to five working days. That estimate is not a confirmed reopening date, and the November 13 update gives no new date. Logins have been disabled since November 9, and the exchange said it will share further updates as additional findings are established.

This article is news reporting and is not investment advice.

Sources

• Unocoin, Security Incident Update, Unocoin, November 12, updated November 13, 2026 (primary source: BitGo froze Unocoin's enterprise account on November 6, 2026 at 11:29 UTC as instructed, and the freeze has so far been found to have functioned as intended; the transactions in question were signed and broadcast externally on-chain directly, without BitGo's platform or involvement; the backup mechanism in BitGo multisignature wallets, designed so funds remain accessible if BitGo disappears, seems to have been exploited; the investigation continues into the mechanism, the loss of cryptocurrency and information privacy)
• TokenPost, Unocoin Says BitGo Freeze Appears Effective Amid Suspected Wallet Backup Exploit, November 13, 2026 (secondary source: BitGo's freeze of the corporate account appeared to be working as intended as Unocoin investigates suspected use of a multisignature wallet backup and possible asset or information losses; the freeze followed Unocoin's November 6 instruction to BitGo after the company detected suspicious, unauthorised activity)
• CoinGabbar, Unocoin Hack News: BitGo Backup Path Suspected, November 13, 2026 (secondary source: the firm says the freeze on its enterprise account, requested on November 6, 2026, worked as intended; the transactions were signed and broadcast on-chain without BitGo's platform or involvement; BitGo wallets use a 2-of-3 key setup, a user key, a backup key and a BitGo key, and the backup key lets a client reach funds if the custodian is ever unavailable)
• CoinScreamer, Unocoin Suspects BitGo Wallet Backup Path Was Exploited, November 13, 2026 (secondary source: the explanation remains Unocoin's assessment, and it has not published a transaction-level reconstruction identifying the exact signing credentials used, the initial route of compromise or a confirmed loss total; more than 90 percent of customer cryptocurrency is held in cold storage, while the complete holdings assessment remains underway)