Unocoin has suspended all services following a security breach where hackers exploited a backup wallet access mechanism to bypass BitGo's freeze protocols. The exchange reported that unauthorized transfers were signed and broadcast outside BitGo's control, despite the freeze on its enterprise account. Unocoin is currently investigating how the backup mechanism was misused, the extent of cryptocurrency losses, and potential exposure of user information.
The incident began on Nov. 6 when Unocoin detected unauthorized activity, leading to freezes on its BitGo and Fireblocks accounts. On Nov. 9, the exchange halted all services after identifying further suspicious transactions. Unocoin noted that over 90% of customer funds were held in cold storage, though the full impact of the breach remains under assessment.
BitGo's documentation reveals that its wallet system uses three keys: user, backup, and BitGo keys. Normally, transactions require the user and BitGo keys, but the backup key can pair with the user key to bypass BitGo's withdrawal policies. This recovery feature, designed to maintain access if BitGo becomes unavailable, appears to have been exploited in this incident.
Unocoin's latest update confirms that efforts to restore services are ongoing, but key questions remain unanswered, including how the recovery path was accessed and the full extent of the losses. The exchange has not provided a timeline for resuming operations.