On November 13, 2026, Indian cryptocurrency exchange Unocoin confirmed that attackers had carried out unauthorized on-chain transactions by exploiting its multisignature wallet backup system. The attackers bypassed an account freeze imposed by its custodian, BitGo, by accessing emergency recovery keys stored on Unocoin’s compromised servers.
Unocoin first detected suspicious activity on November 6 and immediately requested account freezes from both BitGo and Fireblocks. BitGo successfully restricted access to the exchange’s corporate dashboard, preventing transactions from being initiated through its platform. However, attackers had already compromised Unocoin’s server infrastructure and gained access to its emergency recovery keys.
Update on 13 November 2026
Our team received all the needed information and clarifications from BitGo. They froze Unocoin’s enterprise as per our instructions on 6th November 2026, and it is so far found that the freeze has functioned as intended. Technically, transactions in question have got signed and broadcasted externally on-chain directly without BitGo’s platform or involvement. BitGo multi signature wallets get created in such a way that we can still access crypto funds if BitGo ever disappear. Such a backup mechanism seems to be exploited and we investigate this further to understand the mechanism, loss of cryptocurrency and information privacy.
We are still working on completing our investigation and bringing back our services. We will share any new significant updates as they get established.
Team Unocoin
— Unocoin: India’s Bitcoin & Crypto Exchange (@Unocoin) November 13, 2026
These keys were designed to allow Unocoin to recover its assets independently if BitGo became unavailable. Instead, the attackers used them to authorize and broadcast Ethereum and ERC-20 token transfers directly to the blockchain, bypassing BitGo’s platform restrictions.
Following the incident, Unocoin suspended all user logins, deposits, and withdrawals while rebuilding its entire server infrastructure from scratch. The exact amount stolen remains unknown because of the complexity of BitGo’s change-address architecture. However, Unocoin stated that more than 90% of customers’ cryptocurrency remains safe in offline cold storage.
Read also: India Prepares New Rules To Control Artificial Intelligence Within 30 Days
Why BitGo’s account freeze failed to stop the attack
The exploit highlights a major weakness in how institutional cryptocurrency custody systems are designed and understood. Although Unocoin requested an account freeze, the restriction only blocked access to BitGo’s centralized web interface. It did not prevent transactions authorized through external backup keys.
Alphax_DEX ambassador on X, @Zorven, highlighted this technical limitation, arguing that an institutional freeze that cannot stop on-chain transfers is effectively just a user interface restriction. Zorven also pointed to a basic principle of cryptocurrency security: a multisignature wallet is only as secure as the parties holding its backup keys.
@Cointelegraph A freeze that doesn’t stop onchain transfers is just a UI setting.
Multisig is only as strong as whoever holds the backup key.
— Zorven (@Zorvenss) November 13, 2026
The incident also raised questions about the reliability of enterprise-grade cryptocurrency custody. Perp trader on X, @Mari, questioned what a custodial account freeze actually means if a secondary recovery mechanism can still move funds from a supposedly locked account.
@Cointelegraph if a multisig backup can still move funds on a frozen account then what does frozen even mean lol… scary for custody imo
— Mari (@Maribtxn) November 13, 2026
For retail investors who rely on centralized exchanges to protect their assets, the incident shows that even when a custodian successfully restricts access to its platform, attackers may still find another way to move funds directly on-chain.
Read also: India Loses Its Spot as Asia’s Favourite Stock Market Despite Inflows
Emergency recovery keys expose a critical custody risk
The breach also highlights the security risks associated with emergency recovery systems. These mechanisms are important because they allow wallet owners to regain access to their funds if a custodian goes offline or becomes unavailable. However, they can also create a major security weakness when the client’s internal servers are compromised.
Fast Buckz on X, noted this problem, noting that the account freeze failed to stop the unauthorized transfers. The user also identified the backup mechanism as the biggest unresolved issue and called on BitGo to explain exactly how attackers managed to bypass its restrictions.
@Cointelegraph So the account freeze didn’t stop the transfers after all? The backup mechanism is now the biggest question.
BitGo needs to explain exactly how this was possible.
— FastBuckz (@fast_buckz) November 13, 2026
Although BitGo’s internal platform was not breached and its systems operated as designed, the incident demonstrates that institutional custody security extends beyond the custodian’s infrastructure.
When attackers can compromise a client’s servers, obtain backup keys, and move funds from an account that has already been frozen, the custodian’s security controls may offer limited protection.
Ultimately, the incident shows that protecting institutional cryptocurrency holdings requires more than securing a custodian’s platform. Exchanges must also protect their internal infrastructure, recovery keys, and transaction authorization systems.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
