Unocoin is targeting BitGo's backup keys
Unocoin stated that the attackers may have exploited a backup mechanism in their BitGo multi-signature wallet, allowing transactions to be signed externally and broadcast on the chain without going through BitGo's platform.
11/14/20263 min read
How backup locks work
BitGo's standard business model is two of three. Customers hold one key, BitGo holds one key, and a third backup key exists so customers can recover their funds if BitGo goes down. That backup key is the crux of the model: it means the fund holder cannot hold customers hostage, and that's why organizations choose this structure over a single-holder model.
The price paid for that guarantee is that the backup key is a complete bypass. Anyone holding the client's key and the backup key can sign and broadcast without BitGo's involvement, which is exactly what Unocoin describes. Freezing the platform then serves no purpose, because the platform is not in the right path.
This is a design feature, not a vulnerability. The feature that protects customers from their fund holders also eliminates the ability for fund holders to prevent withdrawals, and organizations accept that trade-off when they implement this model. What this incident demonstrates is that Unocoin's two independent keys are not, in fact, independent.
The timeline points to a specific point.
Unocoin requested Fireblocks to freeze its account at 11:24 UTC and BitGo at 11:29 UTC on November 6th. No funds were found lost during the review process that same day. Further unauthorized activity was detected on November 9th, leading to the suspension of all services. They subsequently discovered their servers had been compromised. On November 12th, they identified outgoing transactions originating from an Ethereum address within their BitGo infrastructure. They estimated it would take four to five business days to rebuild the servers.
The most crucial detail is that the exchange's own servers were compromised. If the attacker had persistent access to Unocoin's infrastructure, obtaining both the operating key and anything necessary to use the backup path would have been a natural consequence, and the backup mechanism would then be the method, not the cause. The sequence of events also suggests the attacker retained access after the initial freeze, as new activity reappeared three days later.
Viewing this as a BitGo backup exploit, as the title suggests, places the responsibility on the custodian. Viewing this as a breach of the exchange's servers resulting in access to the operating key places the responsibility on Unocoin. The evidence published supports the second interpretation just as well as the first, and FinanceFeeds was correct in stating that neither of these proves a security vulnerability in BitGo's custody software.
The truth remains undisclosed ?
Seven days after the initial freeze, there was still no estimate of the damage, no information on affected balances, and no recovery date. The company stated that over 90% of customer assets were being stored offline, which offered reassurance about the system architecture rather than a statement about what had been lost.
That silence is paramount for Unocoin customers right now. An exchange that has suspended logins, deposits, withdrawals, and trading, and whose losses remain undetermined after a week, is in an unresolved situation. India's history on this issue is not very favorable, as the 2024 WazirX breach led to a years-long restructuring process in which users only recovered a small fraction of their assets under delayed schedules.
Assessment and Conclusion
Multi-signature signatures are often touted as eliminating single points of failure, and it does indeed eliminate the most obvious point of failure. Instead, it creates a distributed set of points of failure, whose independence is an operational property rather than a cryptographic guarantee. Two out of three only means two out of three if those two are actually kept separate, and an attacker within the exchange's infrastructure can access both without bypassing any encryption algorithms.
Similar lessons emerged in the Binance breach two weeks ago, where a container deployment token gained access to the wallet signing system, and in the Sygnum and Debifi multi-signature lending structures where liquidation paths remained untested under pressure. The architectural scheme isn't the controlling factor. The actual location of the keys and what else can access them is what matters.
Disclaimer: The content in this article is for informational, research, data analysis, and reference purposes only regarding the cryptocurrency market. All opinions, assessments, forecasts, or opinions reflect the author's perspective at the time of publication and do not constitute investment advice, solicitations for buying or selling, trading recommendations, advertising, marketing, or promotion of any financial products, services, or cryptocurrencies. Mentions of projects, tokens, protocols, exchanges, wallets, or cryptocurrency service providers (CASPs) are for research, analysis, or informational purposes only and should not be construed as endorsements, recommendations, or guarantees in any way. HCCVenture does not broker, advertise, market, promote, or connect users in Vietnam with any cryptocurrency services from CASPs. HCCVenture does not accept asset custody, investment mandates, manage assets, or execute transactions on behalf of clients. All investment decisions are made entirely through the reader's own research (DYOR), evaluation, and responsibility; HCCVenture is not liable for any losses or damages arising from the use of or reliance on the information presented in this article.
Compiled and analyzed by HCCVenture
Join our information channels: https://link3.to/holdcoincventure
Explore HCCVenture group
HCCVENTURE QUANT JSCO
© 2026 HCCVENTURE. ALL COPYRIGHTS RESERVED.
Connect with us
Popular content
Contact to us
Address: 8th Floor, Bach Dang Complex Building, 50 Bach Dang Street, Hai Chau Ward, Da Nang City, Vietnam.
Phone: 1900 1509
Gmail : sp_contact@hccventure.com
Disclaimer: The information on this website is for informational purposes only and should not be considered investment advice. We are not responsible for any risks or losses arising from investment decisions based on the content here.
TERMS AND CONDITIONS • CUSTOMER PROTECTION POLICY
ANALYTICAL AND NEWS CONTENT IS COMPILED AND PROVIDED BY EXPERTS IN THE FIELD OF DIGITAL FINANCE AND BLOCKCHAIN BELONGING TO HCCVENTURE ORGANIZATION, INCLUDING OWNERSHIP OF THE CONTENT.
RESPONSIBLE FOR MANAGING ALL CONTENT AND ANALYSIS: HCCVENTURE FOUNDER - TRUONG MINH HUY
Read warnings about scams and phishing emails — REPORT A PROBLEM WITH OUR SITE.
