Unocoin

BitGo’s own developer documentation confirms that a client holding a backup key can move funds out of a wallet using a tool that works entirely “without BitGo,” bypassing whatever freeze or policy the custodian has in place. That mechanic now sits at the center of a dispute with Indian exchange Unocoin, which says crypto left a wallet BitGo had already confirmed was frozen.

• Unocoin froze its BitGo and Fireblocks accounts on November 6 after spotting suspicious activity.
• By November 13, Unocoin said funds had moved out of a wallet BitGo confirmed was frozen a week earlier.
• Unocoin says more than 90% of customer crypto remains in cold storage and was not affected.

• 90% share of Unocoin customer crypto held in cold storage
• $44.1M BitGo’s Q3 net income, lifted by treasury gains
• $234M size of the 2024 WazirX hack, a comparable custody dispute

BitGo’s guide to its Wallet Recovery Wizard states the tool lets clients “recover assets from your self-custody wallets, without BitGo,” using a user key and a backup key to sweep assets to a new address.

The documentation warns plainly that “recovery transactions bypass any policies you have with BitGo,” a detail Unocoin now points to after money left a wallet the custodian had already said was locked down.

Unocoin asked BitGo to freeze its company accounts on November 6 after detecting suspicious activity, with the freeze taking effect at 11:29 UTC for BitGo and 11:24 UTC for Fireblocks, according to the exchange’s blog. Both custodians confirmed the freeze and reported no losses at that point.

Then on November 13, Unocoin said crypto had still moved out of the frozen BitGo wallet. The exchange blames a backup recovery path built into BitGo’s multisignature wallets, designed so a client can reach funds even if BitGo itself goes offline, saying in a blog update that the path “appears to have been exploited.”

BitGo’s Recovery Wizard Bypasses Custodian Policies by Design

BitGo’s Wallet Recovery Wizard requires the backup public key, the user public key, the wallet passphrase, and either the BitGo public key or the wallet address to execute a sweep. BitGo recommends running it on an air-gapped machine and notes it relies on third-party block explorers rather than BitGo’s own infrastructure to broadcast transactions.

The setup exists so institutional clients are never locked out if BitGo disappears, a design goal shared across much of the multisig custody industry.