Unocoin froze its BitGo account. The disputed transfers still went out.
Three questions on the incident (CryptoSlate, Nov. 14):
Q: What happened?
Unocoin spotted unauthorized activity on Nov. 6, asked BitGo and Fireblocks to freeze its enterprise accounts, and suspended all services on Nov. 9. It now says the disputed transfers were signed outside BitGo.
Q: How does a freeze miss that?
BitGo's docs list three keys: user, backup and BitGo. Its withdrawal policies only cover transactions involving BitGo, and user+backup recovery signing skips them. Unocoin suspects the backup route was misused; the method is still under investigation.
Q: What's the takeaway?
A provider freeze isn't a blanket lock. Every key that can sign is part of the attack surface. Losses aren't disclosed yet; Unocoin said on Nov. 12 that over 90% of customer funds sat in cold storage.
Which do you check first on a custodian: key setup or reserves? $ETH #Security #Custody
Disclosure: Write to Earn may pay me a commission on cashtag trades.
Three questions on the incident (CryptoSlate, Nov. 14):
Q: What happened?
Unocoin spotted unauthorized activity on Nov. 6, asked BitGo and Fireblocks to freeze its enterprise accounts, and suspended all services on Nov. 9. It now says the disputed transfers were signed outside BitGo.
Q: How does a freeze miss that?
BitGo's docs list three keys: user, backup and BitGo. Its withdrawal policies only cover transactions involving BitGo, and user+backup recovery signing skips them. Unocoin suspects the backup route was misused; the method is still under investigation.
Q: What's the takeaway?
A provider freeze isn't a blanket lock. Every key that can sign is part of the attack surface. Losses aren't disclosed yet; Unocoin said on Nov. 12 that over 90% of customer funds sat in cold storage.
Which do you check first on a custodian: key setup or reserves? $ETH #Security #Custody
Disclosure: Write to Earn may pay me a commission on cashtag trades.