BitGo says it was not breached and the transfers out of Unocoin's BitGo wallets were signed with the two keys Unocoin held

Custody firm BitGo says its systems were not breached in the security incident at crypto exchange Unocoin, and that the money that left Unocoin's BitGo wallets moved with keys Unocoin itself controlled. In a statement on X on November 13, reported by crypto.news, BitGo said its review found the outgoing transactions were signed with Unocoin's user and backup keys and broadcast on-chain without BitGo taking part. No other BitGo clients were affected, it said.

The wallets use a two-of-three setup: Unocoin holds two keys, BitGo holds the third, and any two can approve a transfer. BitGo said its key was not used and that the freeze Unocoin requested on November 6 worked as intended.

Unocoin's own update agrees that the transactions were signed and broadcast outside BitGo's platform. It says the backup mechanism in the multisig wallets, which lets a client reach its funds if BitGo stops operating, "seems to be exploited", and that it is investigating how. The exchange first saw unauthorized activity on November 6, suspended all services on November 9, and on November 12 found outgoing transfers from an Ethereum address in its BitGo setup.

Unocoin has not given a loss figure and says it does not yet have full visibility of every transfer. It says more than 90% of customer crypto is held in cold storage, and its latest update gives no date for services to resume.