Unocoin halts all services after hackers bypass BitGo freeze
Unocoin says disputed transfers were signed outside BitGo while it investigates suspected misuse of a backup mechanism. Read the full story on CryptoSlateUnderstand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
Crypto exchange Unocoin said on Nov. 13 that disputed wallet transfers were signed and broadcast outside BitGo, while the freeze on its BitGo enterprise account had worked so far.
The exchange suspended all services on Nov. 9 after detecting further unauthorized activity. It had requested freezes on its enterprise accounts at BitGo and Fireblocks after initially detecting the activity on Nov. 6.
In its incident update, Unocoin said a backup mechanism designed to preserve access to funds if BitGo became unavailable appeared to have been exploited. It is still investigating how that mechanism was used, cryptocurrency losses, and potential information exposure.
Related ReadingBitGo's wallet documentation describes three keys: the user key, backup key, and BitGo key. Normal transactions use the user and BitGo keys to meet a two-of-three signing requirement. The backup key can instead pair with either of the other two keys.
Pairing the backup key with the user key provides a signing route that does not require BitGo's key, and the two-of-three requirement still applies in that recovery arrangement.
What changes is the pair of keys used to satisfy it: the user and backup keys replace the usual user-and-provider combination, leaving BitGo outside that signing process.
BitGo notes that limit in its withdrawal-policy documentation, saying that those policies apply only to transactions involving BitGo. Recovery transactions using the user and backup keys bypass the policies configured with the provider.