Unocoin confirmed approximately $200,000 in cryptocurrency losses from three of more than 20 operational hot wallets after a Nov. 6 security incident. The exchange initially said on Nov. 9 that intervention with custody providers had prevented losses, but subsequent forensic work identified unauthorized transactions, including outgoing transfers from an Ethereum address in its BitGo wallet infrastructure. BitGo said its systems were not breached: the transfers were signed with Unocoin-held user and backup keys and broadcast directly on-chain outside BitGo’s platform. Unocoin’s two keys in a two-of-three multisignature arrangement could authorize transactions without BitGo’s third key, which was never used. Investigators found that backup signing keys generated about eight years earlier and stored on paper in secure physical storage had been compromised, although the access method remains unresolved; a decryption passphrase was found in compromised infrastructure. The loss was less than 1% of customer cryptocurrency assets, and Unocoin said it would absorb the shortfall without reducing customer balances. It also froze part of the affected funds, without disclosing the amount. More than 90% of customer crypto assets were reportedly held in cold storage. Unocoin suspended services, rebuilt infrastructure and investigated potential exposure of email and residential addresses, encrypted passwords, account balances and know-your-customer information; it said no identity-verification documents had been shown to be accessed.