Unocoin says crypto left one of its wallets even though it froze its BitGo account in its latest update on the exploit it suffered.
Unicoin thinks a backup recovery path in BitGo’s (NYSE: BTGO) multisignature wallets was used to move its funds, but it does not know who the perpetrator is.
How did crypto leave a wallet that was frozen?
Unocoin asked BitGo to freeze its company accounts on November 6 after it spotted suspicious activity. Its blog says the freezes began at 11:24 UTC for Fireblocks and 11:29 UTC for BitGo. Both custodians confirmed the freezes, and no losses were found at that point.
However, on November 13, Unocoin said its money was moved out of the wallet that BitGo confirmed was frozen. Unocoin says BitGo’s multisignature wallets have a backup path that is meant to let a client reach funds even if BitGo goes offline.
Unocoin says this path “appears to have been exploited” and that it is now checking how it was reached and used.
BitGo’s own documents point fingers at its clients instead. Its Wallet Recovery Wizard lets clients take assets out of their wallets “without BitGo.” It uses the user key and the backup key to move funds to a new address.
BitGo’s documents say these recovery transactions “bypass any policies you have with BitGo.” The recovery wizard requires the backup public key, the user public key, the wallet passphrase, and either the BitGo public key or the wallet address to operate.
Who is to blame for Unocoin’s lost crypto?
Unocoin has not named who controlled the key, and it has also not stated how much crypto was lost. The company has confirmed, however, that more than 90% of customer crypto is in cold storage.
After Unocoin suspended all services on November 9, it traced outgoing transactions from an Ethereum address in its BitGo wallets and by November 12, it had found out that that address had been used to fund ERC-20 tokens.
Unocoin says BitGo’s change-address setup makes it hard to rebuild the full transaction history. It is now rebuilding its whole server stack, which it expects to take four to five working days.
Still on November 12, about 80,986 Unocoin-linked addresses on Arkham Intelligence showed a total value of zero. But the same report said those labeled wallets held only hundreds of dollars at most over the past month. Their three-month peak was just over $250,000.
In a situation similar to BitGo and Unocoin’s, WazirX and its custody partner Liminal spent months blaming each other after the $234 million WazirX hack in July 2024. Liminal claimed that all transactions originated from its client’s end, while WazirX argued that the loss was due to a fault in the Liminal platform.
Separately, BitGo recently reported its third-quarter results. It recorded a net income of $44.1 million, driven by a rise in the value of its digital asset treasury. The company’s report puts the unrealized gain at $71.5 million.
The smartest crypto minds already read our newsletter. Want in? Join them.