The Indian exchange first froze its custody accounts on November 6, yet outgoing transactions later appeared from one of its ETH addresses at BitGo. A 13 November update to its incident report says the transfers were signed and broadcast on-chain directly, without BitGo's platform or involvement.

BitGo's investigation found that the November 6 freeze worked as intended. Unocoin believes the backup mechanism of BitGo multisig wallets, which lets a client recover funds if BitGo itself goes offline, was exploited instead. The exchange has not disclosed the amount lost or a root cause.

More than 90% of customer crypto is held in cold storage, the exchange says.

Unocoin suspended all services on November 9 after further unauthorized activity and is rebuilding its server infrastructure from scratch, a process it expects to take 4 to 5 working days. The breach shows how a compromised client environment can bypass a custodian's account freeze.