Can multisig go wrong too? Of the 3 keys, the exchange held 2
Suspicious transfers were spotted at Indian exchange Unocoin. Custodian BitGo shared details on 11/13:
· Unocoin used a "2-of-3" self-custody multisig setup: Unocoin held both the user's key and the backup key, while BitGo held only the third key.
· The suspicious transactions were signed using Unocoin's 2 keys, bypassing BitGo and going straight to the blockchain. BitGo's key was never used.
· The account had been frozen on 11/6 at Unocoin's request, and the freeze worked as designed; BitGo says its systems were not compromised.
Unocoin said the same day that this multisig setup was designed so funds could be recovered "even if BitGo disappeared," but that this backup mechanism "appears to have been exploited." The extent of the losses and the status of the data are still under investigation, and services have not yet resumed. The two parties have given different accounts, and responsibility has not been determined.
If you use multisig, check these 3 things:
1. Are the keys needed to meet the threshold held by the same person, on the same device, or in the same place? If so, it's effectively a single-signature setup.
2. Keep backup keys offline and stored separately—not together with your everyday keys.
3. A third party's freeze only controls its own key; it can't stop the other two keys from signing together.
Follow me. When an exchange has an incident, I only relay the parties' exact words, then break down what you can learn to protect your own wallet.
#多签 #钱包安全 #SecurityAlert
Suspicious transfers were spotted at Indian exchange Unocoin. Custodian BitGo shared details on 11/13:
· Unocoin used a "2-of-3" self-custody multisig setup: Unocoin held both the user's key and the backup key, while BitGo held only the third key.
· The suspicious transactions were signed using Unocoin's 2 keys, bypassing BitGo and going straight to the blockchain. BitGo's key was never used.
· The account had been frozen on 11/6 at Unocoin's request, and the freeze worked as designed; BitGo says its systems were not compromised.
Unocoin said the same day that this multisig setup was designed so funds could be recovered "even if BitGo disappeared," but that this backup mechanism "appears to have been exploited." The extent of the losses and the status of the data are still under investigation, and services have not yet resumed. The two parties have given different accounts, and responsibility has not been determined.
If you use multisig, check these 3 things:
1. Are the keys needed to meet the threshold held by the same person, on the same device, or in the same place? If so, it's effectively a single-signature setup.
2. Keep backup keys offline and stored separately—not together with your everyday keys.
3. A third party's freeze only controls its own key; it can't stop the other two keys from signing together.
Follow me. When an exchange has an incident, I only relay the parties' exact words, then break down what you can learn to protect your own wallet.
#多签 #钱包安全 #SecurityAlert
