BitGo: Unocoin's Outbound Transactions Were Signed by Its Two Self-Held Keys; BitGo's Third Key Was Not Used

Odaily reports: According to BitGo monitoring, its system was not compromised. The recent outbound transactions from Unocoin were signed by Unocoin's self-held user key and backup key, and were broadcast directly on-chain outside the BitGo platform; BitGo's third key was never used, and other clients were unaffected. Unocoin uses a 2-of-3 self-custody wallet, in which the user key and backup key alone are sufficient to authorize transactions. On November 12, Unocoin discovered outbound transactions from an Ethereum address in its BitGo wallet infrastructure. On November 13, it stated that it had received an explanation from BitGo and that the freeze had taken effect, with the transactions having been signed and broadcast outside the platform. Unocoin suspects that a backup mechanism set up to guard against BitGo unavailability was exploited, and is currently investigating the method of access, asset losses, and personal information leakage. Neither party has disclosed the identity of the key user or confirmed the amount of losses. On November 6, Unocoin detected suspicious activity and requested that Fireblocks and BitGo freeze the accounts; on November 9, after disclosing unauthorized server access, it disabled logins and subsequently suspended all services, stating that more than 90% of customer crypto assets are held in cold storage.