CoinCover Statement on the Unocoin Security Incident

Unocoin on 12 November reported that funds were sent from one of their ETH addresses in their BitGo wallet infrastructure. This was despite the wallet having previously been frozen after suspicious activity was detected. They have confirmed that 90% of their customers’ funds are secured in cold storage.

It has been separately reported that Unocoin believes that a backup recovery path in their BitGo wallet may have been used to move the funds.

CoinCover customers remain fully secure

We would like to underscore that CoinCover was not involved in this incident. The Unocoin wallet did not use CoinCover’s Disaster Recovery Services (DRS). All key material backed up with CoinCover remains fully secure.

BitGo provides their customers with an option to self-backup, or to use CoinCover as a third-party disaster recovery service. Unocoin appears to have relied on the self-backup feature: BitGo has reported that Unocoin used a 2-of-3 self-custody setup in which Unocoin holds two keys, the user key and the backup key. BitGo held the third key, which was never used.

We sympathise deeply with the Unocoin team. This incident nonetheless underlines how critical third-party disaster recovery is.

How we backup secure key material

All BitGo backups held with CoinCover as a third-party disaster recovery service are held in cold storage, behind multiple layers of digital and physical security.

In order to exploit a backup held in cold storage, a criminal would need to be able to bypass personnel verification and access controls, access a location with multiple levels of physical security, and decrypt and then reconstruct key material.

This level of security cannot easily be replicated by in-house teams when they self-backup. As a consequence, self-backing up exposes key material to the same level of threat as any other in-house systems in an exploit. Countering this threat is driving widespread adoption of third-party disaster recovery solutions such as CoinCover’s.

We're here to help

If you have any questions or would like to review your backup setup or recovery processes, our team is here to support you. Contact us at support@coincover.com.