Unocoin, one of India's longest-running cryptocurrency exchanges, has kept its platform locked down — deposits and withdrawals both suspended — as it investigates a cluster of transfers that appear to have been executed without proper authorization. The nature of the breach, if confirmed, strikes at something foundational: the integrity of institutional-grade custody infrastructure at a moment when Indian crypto firms are already navigating one of the world's most demanding regulatory environments.
At the center of the investigation is BitGo, the digital asset custody provider that Unocoin relies on to secure client funds. According to Unocoin, the suspicious transfers were signed outside BitGo's platform entirely — a critical detail, because signing activity that circumvents the custodian's core infrastructure is precisely the kind of anomaly that standard security protocols are designed to prevent. What compounds the concern is the timing: Unocoin's BitGo account was reportedly frozen when these transfers occurred.
How does a frozen account generate signed transactions? Unocoin has floated one possible explanation: a wallet recovery feature. Recovery mechanisms are designed as fail-safes — a way to access funds if primary systems become unavailable. But like most emergency override tools, they carry an inherent risk. In the wrong hands, or in an insufficiently protected implementation, a recovery pathway becomes an attack vector. If the transfers were indeed routed through such a feature, it raises immediate questions about who had access to the recovery credentials, whether that access was authorized, and how the signing occurred without triggering real-time alerts on BitGo's side.
BitGo occupies a significant position in the institutional crypto custody market, serving exchanges, funds, and corporate treasuries globally. Its platform is built around multi-signature (multisig) authorization — meaning any transaction should require sign-off from multiple independent keys before it can be executed. Transactions signed outside that framework are, by definition, operating outside the agreed security perimeter. That Unocoin is now investigating exactly this scenario suggests either a sophisticated external compromise, an internal credentialing failure, or an edge case in how the recovery feature interacts with account freeze protocols — none of which are comfortable possibilities for an exchange with active retail users.
For Unocoin's customers, the freeze is a direct disruption. The exchange has not restored deposit or withdrawal functionality while the probe continues, leaving users unable to move funds in or out of the platform. This kind of operational halt always tests customer trust, and in India, where the crypto sector has spent years building credibility against a backdrop of regulatory skepticism and high transaction taxes, the reputational stakes for any exchange experiencing custody anomalies are particularly acute. The country's financial regulators have made clear they expect exchanges operating in India to maintain rigorous compliance and security standards — a security incident of this nature will draw scrutiny regardless of how it ultimately resolves.
The episode also invites a broader conversation about the architecture of custody in emerging market crypto exchanges. Outsourcing custody to established providers like BitGo is widely regarded as the responsible choice for exchanges that lack the engineering depth to build sovereign multisig infrastructure. But outsourcing custody is not the same as outsourcing custody risk. Exchanges remain accountable to their users for whatever happens to funds under management, regardless of which third-party system failed or was circumvented. Unocoin's situation illustrates this accountability gap in sharp relief: the technical anomaly may have originated in BitGo's ecosystem, but Unocoin's users are the ones who cannot access their funds.
What this means in practice is that the investigation's outcome matters far beyond Unocoin's immediate platform status. If the transfers are traced to an exploitation of the wallet recovery feature, it will force a re-examination of how custodians implement and protect emergency access pathways across the industry. If the source turns out to be credential theft or insider access, it speaks to a different category of risk that no custody provider can fully engineer away. Either scenario demands transparent disclosure — to users, to regulators, and to the broader market — about what happened, when it happened, and what controls have been strengthened as a result. The longer the platform remains locked and the more sparse the public communication, the harder it becomes to separate a genuine security response from crisis management theater.
Unocoin has not yet provided a timeline for restoring normal operations. Until the origin of these out-of-platform, freeze-era transactions is established with certainty, the exchange appears to have made a deliberate choice to prioritize containment over commerce. That may be the right call. But it is a call that the exchange's users, and India's crypto market, are absorbing in real time.
Written by the editorial team — independent journalism powered by Bitcoin News.