Unocoin Pauses Deposits and Withdrawals After Suspect Transfers

Indian crypto exchange Unocoin has halted all deposits and withdrawals while it investigates suspicious transfers involving wallets tied to institutional custody provider BitGo. The suspension underscores how quickly operational risk can escalate for exchanges—particularly when third-party custody infrastructure is involved and when unauthorized activity may have exploited wallet functionality outside the custodian’s direct platform.

Unocoin said it has been working to determine whether transfers were made using a recovery feature present in BitGo multisignature wallets. The exchange has not provided a timeline for resuming services, and it has not confirmed whether any digital assets were ultimately lost. Separately, India’s cybersecurity agency previously warned of an AI-assisted campaign targeting crypto exchanges, though Unocoin’s incident has not been linked to that activity.

Key takeaways

• Unocoin has suspended deposits and withdrawals while investigating suspicious transfers connected to BitGo-linked wallets.
• Unocoin says BitGo froze Unocoin’s enterprise account at Unocoin’s request on Nov. 6, and the freeze “worked as intended.”
• The exchange suspects BitGo multisignature wallets’ recovery feature may have been misused, enabling transactions to be signed and broadcast outside BitGo’s platform.
• Unocoin has not disclosed whether it lost any digital assets and has not announced when services will restart.
• A prior Indian cybersecurity warning described an AI-assisted threat campaign aimed at exchanges, but no direct connection has been established.

Unocoin pauses user flows amid BitGo wallet investigation

Unocoin’s decision to stop deposits and withdrawals comes after the exchange detected suspicious activity it traced to wallet infrastructure associated with BitGo. According to Unocoin, it began investigating after noticing unauthorized activity on Nov. 6, and it later suspended all services on Monday after detecting additional activity.

What makes the case particularly sensitive is the custody architecture. BitGo is widely used by crypto firms that need institutional-grade controls for assets held in multisignature wallets. In Unocoin’s account, the issue may have involved transfers that were not executed through BitGo’s platform in the usual way—raising the possibility that the underlying wallet mechanism, not the custodian’s interface, could have been used to move funds.

BitGo freeze, but transactions reportedly signed outside its platform

In a statement made available via Unocoin’s social media announcement, the exchange said BitGo froze Unocoin’s enterprise account on Nov. 6 at Unocoin’s request. Unocoin stated that the freeze “worked as intended,” referring to the controls that BitGo applied to Unocoin’s enterprise account.

However, Unocoin’s investigation found that the transactions being examined were “signed and broadcast outside BitGo’s platform.” In other words, even with BitGo’s enterprise account frozen, some activity relevant to the investigation may have continued in a manner that bypassed the custodian’s normal transaction path.

Recovery feature suspicion and the open question of losses

Unocoin’s central concern is whether BitGo multisignature wallets included—and were used through—a recovery feature. In its explanation, the recovery capability allows wallet holders to access funds if BitGo becomes unavailable. Unocoin suspects this recovery feature was misused.

At the same time, the exchange has not yet established key details, including how the transfers occurred or whether Unocoin lost any digital assets. The lack of confirmed loss figures means customers and market participants still lack the clearest metric for severity: how much exposure was moved or whether withdrawals were ultimately prevented from reaching outside parties.

For users, the practical impact is straightforward even without final accounting: deposits and withdrawals remain paused, and the exchange has not provided a return date. For investors and counterparties, the incident raises broader questions about how recovery and authorization flows in multisignature custody should be monitored, audited, and protected—especially when third-party tools enable access paths beyond standard custodial operations.

Earlier disclosures and a broader threat backdrop in India

Unocoin first disclosed suspicious activity on Thursday, describing outgoing transactions from an Ethereum address within its BitGo wallet infrastructure. In that disclosure, the exchange said its servers had been compromised. The sequence suggests that Unocoin believes the initial access vector may have been an intrusion into its own systems, which could then have affected how wallet operations were triggered.

Unocoin has not announced when services will be restored. That uncertainty matters because the longer deposits and withdrawals remain suspended, the more the exchange’s risk management and customer reconciliation processes come under scrutiny—particularly when recovery mechanisms and off-platform transaction signing are part of the investigation.

The incident also lands in a wider climate of concern for digital asset infrastructure. A Nov. 5 warning from India’s cybersecurity agency described an AI-assisted campaign targeting crypto exchanges and other financial firms. While Unocoin’s case has not been connected to that campaign, the background may help explain why exchanges are accelerating security checks and incident response planning during periods of elevated threat activity.

What to watch next

Unocoin’s next steps—especially any update clarifying whether digital assets were lost, how the suspected recovery misuse occurred, and what controls will change going forward—will be crucial for assessing customer risk and rebuilding confidence. Until then, the key question remains whether the “off-platform” signing and broadcasting path can be fully explained and contained.