Unocoin halts all services after hackers bypass BitGo freeze

The exchange requested freezes on its enterprise accounts at BitGo and Fireblocks after initially detecting the unauthorized activity on Nov. 6. It suspended all services on Nov. 9 after detecting further unauthorized activity.

Unocoin reported identifying outgoing transactions on Nov. 12 from an Ethereum address within its BitGo wallet infrastructure used to fund ERC-20 tokens. Its Nov. 13 explanation attributes the disputed activity to external signing.

The incident update states that a backup mechanism designed to preserve access to funds if BitGo became unavailable appeared to have been exploited. It is still investigating how that mechanism was used, cryptocurrency losses, and potential information exposure.

Two routes to a wallet signature exist. Normal transactions use the user and BitGo keys to meet a two-of-three signing requirement. The backup key can instead pair with either of the other two keys.

Pairing the backup key with the user key provides a signing route that does not require BitGo's key, and the two-of-three requirement still applies in that recovery arrangement. The user and backup keys replace the usual user-and-provider combination, leaving BitGo outside that signing process.

BitGo notes that limit in its withdrawal-policy documentation, saying that those policies apply only to transactions involving BitGo. Recovery transactions using the user and backup keys bypass the policies configured with the provider.

In the Nov. 12 report, Unocoin said more than 90% of customer cryptocurrency funds were maintained in cold storage. It was still establishing the complete status of holdings and potential exposure, so that statement does not settle the loss assessment.

Unocoin's latest update said work to restore services continued. Unresolved questions include how the suspected recovery path was accessed, what losses or information exposure resulted, and when services can resume.