Indian cryptocurrency exchange Unocoin has kept both deposits and withdrawals suspended after the platform detected a series of suspicious transfers that appear to have been executed without proper authorization through its institutional custody provider, BitGo. The incident raises urgent questions about the security boundaries of third-party wallet custody infrastructure and what happens when transfers can be signed entirely outside a provider's own platform — even when the associated account is supposed to be frozen.
At the core of the investigation is a troubling technical anomaly: the suspect transfers were cryptographically signed outside of BitGo's platform at a time when Unocoin's account with the custodian had already been placed in a frozen state. That detail alone elevates this beyond a routine security incident. If confirmed, it would suggest that transaction signing authority was exercised through an alternative pathway — one that circumvented the account-level controls that BitGo had in place. Unocoin has indicated that the wallet recovery feature may have been the mechanism through which these transfers were initiated, a function designed as a failsafe but one that could represent a critical attack surface if improperly accessed.
Wallet recovery features are a double-edged instrument in institutional crypto custody. They exist to ensure that a client's assets are not permanently inaccessible in the event of a platform failure or key loss — a legitimate and necessary safeguard given the irreversible nature of on-chain transactions. However, the same recovery pathways that protect funds from being lost can, in the wrong hands or under inadequate access controls, become a vector for unauthorized movement of assets. The question investigators must now answer is who initiated the recovery process, under what credentials, and whether any internal or external actor exploited this pathway deliberately.
For Unocoin's users, the suspension of both deposits and withdrawals represents a significant disruption. The exchange, one of India's longest-operating crypto trading platforms, built much of its early reputation on reliability during a period when the Indian regulatory environment for digital assets was deeply hostile. That history makes the current operational freeze all the more striking. The platform has not disclosed the total value of assets potentially affected by the suspect transfers, nor has it provided a timeline for restoring normal services — both pieces of information that its user base urgently requires.
The incident arrives against a backdrop of intensifying scrutiny on crypto exchanges operating within India. Indian regulators and financial intelligence authorities have been tightening their grip on the sector, demanding greater transparency over custody arrangements, transaction provenance, and anti-money laundering controls. Any suggestion that an exchange's custodial infrastructure has been compromised — even partially — will invite regulatory attention that extends well beyond the immediate security review. Unocoin will almost certainly face questions from Indian financial regulators about its custody governance frameworks and the adequacy of its oversight of third-party wallet providers.
BitGo, for its part, is one of the most prominent institutional-grade digital asset custodians globally, holding regulatory trust licenses across multiple jurisdictions. The firm's platform is used by hundreds of exchanges and institutional clients to manage private key security and transaction authorization. The allegation that transfers were signed outside BitGo's platform — during an account freeze — will inevitably prompt scrutiny of how recovery key materials are stored, who holds access to them, and whether the custodian's operational procedures were followed at every step. BitGo has not yet made a public statement on the matter as of publication.
What This Means for Custody Governance
The Unocoin incident crystallizes a risk that compliance officers and institutional custody specialists have long flagged but that rarely receives sufficient attention until an event forces it into the open: the security perimeter of a custodial account is only as strong as every access pathway to its signing keys — including emergency and recovery pathways. Exchanges that delegate custody to third-party providers must maintain rigorous contractual clarity about who controls recovery credentials, under what conditions they can be exercised, and what audit trails must be generated when they are used. The fact that transfers could apparently be signed while an account was frozen suggests that freeze controls and recovery controls may have been operating in separate, non-communicating silos.
Until Unocoin completes its investigation and publishes a credible account of what occurred — including independent forensic verification — its users face the uncomfortable reality of an indefinite hold on their funds. For the broader Indian crypto market, the episode serves as a pointed reminder that institutional custody arrangements require the same depth of due diligence as the exchanges themselves. The integrity of the entire custody chain, not just the exchange's own systems, must be verifiable at every link.
Written by the editorial team — independent journalism powered by Codego Press.