黑客绕过 BitGo 冻结后 Unocoin 停止所有服务
原文：Unocoin halts all services after hackers bypass BitGo freeze
英文正文：点「译成中文」可整篇机器翻译（免费通道，不花钱），翻好永久缓存、下次秒开。
Unocoin 表示，在调查涉嫌滥用备份机制的同时，有争议的转账是在 BitGo 之外签署的。阅读 CryptoSlate 上的完整故事 了解重要的加密故事以及接下来要观看的内容。将催化剂放入您的收件箱
Unocoin halts all services after hackers bypass BitGo freeze
Unocoin says suspected misuse of backup wallet access enabled unauthorized transfers outside BitGo as the exchange investigates losses.
Editor-in-Chief • CryptoSlate2 min read
Quick Take
- 01 Unocoin says disputed transfers were signed outside BitGo while its enterprise account freeze had so far worked.
- 02 BitGo documents recovery signing with user and backup keys that bypasses withdrawal policies requiring its involvement.
- 03 Unocoin is investigating suspected backup misuse, cryptocurrency losses and information exposure while working to restore suspended services.
Crypto exchange Unocoin said on Nov. 13 that disputed wallet transfers were signed and broadcast outside BitGo, while the freeze on its BitGo enterprise account had worked so far.
The exchange suspended all services on Nov. 9 after detecting further unauthorized activity. It had requested freezes on its enterprise accounts at BitGo and Fireblocks after initially detecting the activity on Nov. 6.
In its incident update , Unocoin said a backup mechanism designed to preserve access to funds if BitGo became unavailable appeared to have been exploited. It is still investigating how that mechanism was used, cryptocurrency losses, and potential information exposure.
The catch in recovering a hacked crypto wallet: the thief may still have a key
Two routes to a wallet signature
BitGo's wallet documentation describes three keys: the user key, backup key, and BitGo key. Normal transactions use the user and BitGo keys to meet a two-of-three signing requirement. The backup key can instead pair with either of the other two keys.
Pairing the backup key with the user key provides a signing route that does not require BitGo's key, and the two-of-three requirement still applies in that recovery arrangement.
What changes is the pair of keys used to satisfy it: the user and backup keys replace the usual user-and-provider combination, leaving BitGo outside that signing process.
BitGo notes that limit in its withdrawal-policy documentation , saying that those policies apply only to transactions involving BitGo. Recovery transactions using the user and backup keys bypass the policies configured with the provider.
An account freeze and a wallet signature control different routes
BitGo documents a recovery route that pairs the user and backup keys without its participation.
Compare documented signing routes
Compare documented signing routesThe user and BitGo keys sign. BitGo participates, and its withdrawal policies apply.
The user and backup keys sign without BitGo. Its withdrawal policies are bypassed.
A provider's withdrawal controls do not cover every combination of keys that can sign a wallet transaction.
General BitGo documentation, not a reconstruction of Unocoin's incident. The exact keys and process used in that incident remain unestablished by this diagram.
Sources and evidence
Sources
Supporting facts
- BitGo documents three wallet keys: user, backup and BitGo; normal transactions use the user and BitGo keys for a two-of-three signature, while the backup key can pair with either other key. [1]
- BitGo says withdrawal policies apply only to transactions involving BitGo, and recovery transactions using the user and backup keys bypass those policies. [2]
Method
Qualitative diagrams of the normal user-plus-BitGo route and the documented user-plus-backup recovery route. Connectors show signing participation, not value, timing or transaction flows.
Scope
General BitGo documentation, not a reconstruction of Unocoin's incident. The exact keys and process used in that incident remain unestablished by this diagram.
This recovery capability preserves access when the provider is unavailable and helps explain why an account freeze cannot be treated as a blanket restriction on every transaction the wallet's keys can sign.
Unocoin reported identifying outgoing transactions on Nov. 12 from an Ethereum address within its BitGo wallet infrastructure used to fund ERC-20 tokens. Its Nov. 13 explanation attributes the disputed activity to external signing, while the suspected misuse of backup access remains under investigation.
In the Nov. 12 report, Unocoin said more than 90% of customer cryptocurrency funds were maintained in cold storage. It was still establishing the complete status of holdings and potential exposure, so that statement does not settle the loss assessment.
Unocoin's latest update said work to restore services continued. Unresolved questions include how the suspected recovery path was accessed, what losses or information exposure resulted, and when services can resume.
Editorial credits
Gino Matos Reporter • CryptoSlate Gino Matos is a law school graduate and a seasoned journalist with six years of experience in the crypto industry. His expertise primarily focuses on the Brazilian blockchain…
More from Gino
The Catalyst
Know what’s moving crypto.
I’m interested in…Thanks for signing up.
Thanks for signing up to The Catalyst. Look out for your first daily email. If you already receive it, you’re all set.
Free newsletters. Unsubscribe anytime.正文由本站服务器抓取保存（已自动过滤广告、推荐位与追踪图片），排版与原站可能不同；版权归原站所有。
