Shiba Inu

Tornado

WazirX

Elon Musk

The massive $235 million hack on the Indian cryptocurrency exchange WazirX on July 18 has raised serious questions about exchange security and the future of cryptocurrency in India.&nbsp;
The <a href="https://cointelegraph.com/news/indian-crypto-exchange-wazirx-hack-235m" rel="noopener noreferrer nofollow">attack unfolded with alarming speed and precision</a>, with Web3 security firm Cyvers being among the first firms to detect “multiple suspicious transactions” involving WazirX’s “Safe Multisig” wallet on Ethereum.
<figure data-ct-non-breakable="true"><img src="https://s3.cointelegraph.com/uploads/2024-07/565fef02-6005-4544-8e36-a904238e706e.png" alt="$235M WazirX exchange hack has implications for India’s crypto industry">
 <figcaption style="text-align: center;">Source: <a href="https://x.com/CyversAlerts/status/1813834131165286464" target="_blank" rel="noopener noreferrer nofollow">Cyvers Alerts</a>
 </figcaption>
</figure>
The attacker was able to move a staggering $234.9 million worth of funds to a new address, with each transaction’s caller being funded with assets from cryptocurrency mixer Tornado Cash.
The stolen funds consisted of a <a href="https://cointelegraph.com/news/wazirx-hacker-converts-149-million-in-altcoins-to-ether" rel="noopener noreferrer nofollow">diverse selection of cryptocurrencies</a>, including Tether (<a href="https://cointelegraph.com/tether-price-index" rel="noopener noreferrer nofollow">USDT</a>), Pepe (<a href="https://cointelegraph.com/pepe-price-index" rel="noopener noreferrer nofollow">PEPE</a>) and Gala (<a href="https://cointelegraph.com/gala-price-index" rel="noopener noreferrer nofollow">GALA</a>), with the attacker swiftly converting these assets into Ether (<a href="https://cointelegraph.com/ethereum-price" rel="noopener noreferrer nofollow">ETH</a>) in an attempt to obfuscate the trail of stolen funds.
The exchange’s wallet also contained approximately $100 million in Shiba Inu (<a href="https://cointelegraph.com/shiba-inu-price-index" rel="noopener noreferrer nofollow">SHIB</a>), $52 million in ETH, $11 million in Polygon’s (<a href="https://cointelegraph.com/polygon-price-index" rel="noopener noreferrer nofollow">MATIC</a>) and smaller amounts of other tokens.
In response to the security breach, WazirX immediately suspended withdrawals of both cryptocurrencies and Indian rupees on the platform. The exchange further announced that it was “actively investigating the incident.”
When asked to comment on the situation, Rajagopal Menon, a spokesperson for WazirX, told Cointelegraph: “We can’t speak to the press right now. You can get updates from our Twitter handle.”
<h2 data-ct-non-breakable="true" id="the-future-of-india-s-crypto-sector">The future of India’s crypto sector</h2>
The hack could have major implications for India’s cryptocurrency sector, which has <a href="https://cointelegraph.com/news/india-tops-chainalysis-2023-global-crypto-adoption-index" rel="noopener noreferrer nofollow">flourished despite government pressure</a>.
Utkarsh Tiwari, the chief strategy officer for Indian cryptocurrency exchange KoinBX, told Cointelegraph that a security breach of this magnitude is bound to cause concern as it affects multiple stakeholders in the crypto ecosystem, including retail investors and other exchanges. He added:
<blockquote data-ct-non-breakable="true">
 “Under India’s G20 presidency, we have seen our government push for comprehensive and standardized regulations for all global Virtual Assets Service Providers. Furthermore, historically, we have seen the Indian government always prioritize investor protection above all else.”
</blockquote>
As a result, Tiwari predicts that Indian digital asset exchanges are likely to invest more heavily in advanced security infrastructure, something he believes can help showcase the resilience and innovation of the Indian digital asset market and community.
India’s crypto industry is anticipating potential relief from the country’s stringent crypto tax regulations.
Recent: <a href="https://cointelegraph.com/news/elon-musk-eu-free-speech-law" rel="noopener noreferrer nofollow">Elon Musk lashes out at EU over ‘illegal’ free speech deal</a>
India Finance Minister Nirmala Sitharaman will present the Union Budget for the next fiscal year on July 23, and the crypto sector hopes for favorable changes.
Since 2022, India has imposed one of the world’s <a href="https://cointelegraph.com/magazine/wazirx-exchange-hackers-fake-tether-scams-asia-express/" rel="noopener noreferrer nofollow">most severe tax regimes</a> on cryptocurrency, with a flat 30% capital gains tax on profits from digital assets, including non-fungible tokens. Additionally, a 1% tax deducted at source (TDS) is also levied on crypto transactions.
Sumit Gupta, CEO of Indian exchange CoinDCX, has been advocating for a reduction in the TDS rate to 0.01% in the forthcoming budget since these tax measures have significantly impacted Indian crypto exchanges.
<h3 data-ct-non-breakable="true" id="how-did-the-attackers-gain-access-to-wazirx">How did the attackers gain access to WazirX?</h3>
Meir Dolev, co-founder and chief technology officer of Web3 security firm Cyvers, told Cointelegraph that while the exploited vulnerability remains unknown, several key facts have emerged since the event.
First, he noted that WazirX uses a multisig wallet that requires four signatures to execute a transaction. The exchange also uses Liminal as a custody provider, which provides the last signature on every transaction. Lastly, WazirX’s wallet has a whitelist policy, with only a few wallets it can send funds to.
Dolev outlined the attack vector: “The attacker used two different addresses, the one that initiated the transaction and the second that received the funds. The one that initiated the transaction needed to pay gas fees so he funded his wallet via Tornado Cash.”
<blockquote data-ct-non-breakable="true">
 “Eight days before the attack, the hacker also deployed a malicious contract that was later used to change the implementation of the WazirX wallet.”
</blockquote>
He further explained that just a few minutes before the first exploit transaction, the attacker managed to change the implementation of their multisig wallet to his malicious contract by using the signatures of WazirX and Liminal custody. “From that moment, he could execute any transaction without needing WazirX or Liminal to sign on the transaction,” he highlighted.
Dolev speculated that the attacker likely compromised WazirX endpoints or laptops to gain the necessary signatures, possibly employing a user interface (UI) hijack on Liminal’s side.
He stated that WazirX might have thought they were going to sign on a legitimate transaction, and this is what it saw in the UI, which was possibly controlled by the hacker.
Liminal Custody has <a href="https://www.newindianexpress.com/business/2024/Jul/18/big-blow-to-crypto-industry-as-wazirx-falls-victim-to-235-million-hack" target="_blank" rel="noopener noreferrer nofollow">insisted</a> that its platform remains secure, with its preliminary investigations showing that one of the self-custody multisig smart contract wallets created outside of the Liminal ecosystem was compromised: “We can confirm that Liminal’s platform is not breached, and Liminal’s infrastructure, wallets, and assets continue to remain safe.”
<h3 data-ct-non-breakable="true" id="north-korean-involvement-suspected">North Korean involvement suspected</h3>
A number of analysts <a href="https://cointelegraph.com/news/wazirx-235m-hack-north-korean-hackers" rel="noopener noreferrer nofollow">believe that North Korean hackers may be</a> responsible for the incident, adding a layer of geopolitical intrigue to an already complex situation.
Blockchain forensics firm Elliptic previously told Cointelegraph that data pointed toward North Korean involvement, explaining, “The North Korea attribution is based on analysis of the onchain transactional behavior and other information. There are certain patterns and techniques that are characteristic of this type of actor.”
This sentiment was <a href="https://x.com/zachxbt/status/1813896375597490177" target="_blank" rel="noopener noreferrer nofollow">echoed</a> by ZachXBT, who said the hack has the potential markings of a Lazarus Group attack — an infamous North Korean criminal organization with a long history of cybercrime.
Since 2017, Lazarus has terrorized the crypto space and is believed to be behind some of the industry’s biggest exploits, including the <a href="https://cointelegraph.com/news/north-korean-lazarus-group-allegedly-behind-ronin-bridge-hack" rel="noopener noreferrer nofollow">$600 million Ronin Bridge incident</a>.
Moreover, in the wake of the hack, the cryptocurrency market experienced significant turbulence. Over $100 million worth of SHIB tokens were taken during the hack, causing the price of the popular memecoin to plummet by 10%.
<figure data-ct-non-breakable="true"><img src="https://s3.cointelegraph.com/uploads/2024-07/f0a0edfa-67f1-4fbd-beff-8825a8c53064.png" alt="$235M WazirX exchange hack has implications for India’s crypto industry">
 <figcaption style="text-align: center;">Seven-day SHIB price chart. Source: CoinMarketCap
 </figcaption>
</figure>
Blockchain analysis platform Lookonchain reported on July 19, one day after the hack, that the attackers had already begun swapping SHIB assets for ETH, selling 35 billion SHIB tokens worth $618,000. At the time, the<a href="https://x.com/hashtag/WazirX?src=hashtag_click" target="_blank" rel="noopener noreferrer nofollow"> </a>exploiter had <a href="https://x.com/lookonchain/status/1814131536935129262" target="_blank" rel="noopener noreferrer nofollow">exchanged</a> most of the assets for 43,800 ETH ($149.46 million) and held a total of 59,097 ETH ($201.67 million).&nbsp;
Recent: <a href="https://cointelegraph.com/news/airdrop-token-prices-crash-web3" rel="noopener noreferrer nofollow">Airdrop token prices are crashing — Does Web3 need a new model?</a>
WazirX has taken swift action to mitigate the damage and recover stolen funds. The exchange has <a href="https://x.com/WazirXIndia/status/1814250505851588932" target="_blank" rel="noopener noreferrer nofollow">filed</a> an official police complaint and is pursuing additional legal actions.
It has <a href="https://cointelegraph.com/news/wazirx-bounty-program-recover-stolen-assets" rel="noopener noreferrer nofollow">reported the incident</a> to the Financial Intelligence Unit and the Indian Computer Emergency Response Team and is contacting over 500 exchanges to block the identified addresses.
The exchange stated, “Many exchanges are cooperating with us, and we are actively working with them on additional resources to aid our recovery efforts.”

$235M WazirX exchange hack has implications for India’s crypto industry

Table of Contents

Cointelegraph

Other articles published on Jul 22, 2024

SEC Gives Green Light for ETH ETFs to Begin Trading Next Tuesday: Sources

ETHTrustFund DAO transfers $2M treasury in apparent rug pull

Somnia's Playground Gives Creators Their Own Slice of The Metaverse

KIP Protocol Partners with Moemate, Onboarding 3 Million AI Users into Web3

Don't Miss Out: Experts Warn Today is the Final Opportunity to Snag Low-Priced Altcoins Before ET...

ChromaWay Resumes Collaboration with EU Implementing Chromia Technology

Join our free newsletter for daily crypto updates!