2024

Polygon

Security

WazirX

On July 18, 2024, WazirX, one of the largest cryptocurrency exchanges,&nbsp;<a style="text-decoration:none" href="https://bsc.news/post/wazir-x-india-suspends-withdrawals-after-234-9-m-theft-reported" rel="noopener noreferrer nofollow">confirmed</a> a significant security breach that resulted in the loss of about $235 million from one of its multisig wallets.&nbsp;
The breach led the exchange to temporarily halt withdrawals of Indian Rupees (INR) and cryptocurrencies, raising alarms within the crypto community.
<h2 dir="ltr" id="span-span-details-of-the-attack-span-span">Details of the Attack</h2>
<h3 dir="ltr" id="span-span-strong-incident-overview-strong-span-span">Incident Overview:</h3>
WazirX&nbsp;<a style="text-decoration:none" href="https://x.com/WazirXIndia/status/1813981143437611440" rel="noopener noreferrer nofollow">reported</a> that the attack targeted a multisig wallet—a wallet requiring multiple private keys to authorize transactions. The compromised wallet had been in use since February 2023, leveraging digital asset custody services provided by Liminal.&nbsp;
&nbsp;
The security breach involved a loss exceeding $230 million, triggering an immediate response from WazirX to secure the remaining assets and address the situation.
<h3 dir="ltr" id="span-span-strong-wallet-configuration-and-breach-mechanics-strong-span-span">Wallet Configuration and Breach Mechanics:</h3>
The affected wallet had six signatories: five from the WazirX team and one from Liminal. Typically, a transaction needed approval from three of the WazirX signatories, who used Ledger Hardware Wallets for added security, followed by final approval from Liminal’s representative.&nbsp;
&nbsp;
Despite these security measures, the breach reportedly occurred due to a mismatch between the data displayed on Liminal’s interface and the transaction details. The transaction payload was apparently manipulated to gain unauthorized control over the wallet.
&nbsp;
According to WazirX, the attack exploited a discrepancy between the data shown and what was signed, likely replacing the transaction payload to redirect funds. Although the multisig wallet and whitelisting policies were in place to safeguard assets, the attackers managed to breach these defenses.
<h2 dir="ltr" id="span-span-response-and-recovery-efforts-span-span">Response and Recovery Efforts</h2>
In response to the hack, WazirX&nbsp;<a style="text-decoration:none" href="https://x.com/WazirXIndia/status/1814250505851588932" rel="noopener noreferrer nofollow">filed</a> a police complaint and initiated additional legal actions.&nbsp;
The exchange reported the incident to the Financial Intelligence Unit (FIU) and CERT-In. They reached out to over 500 exchanges to block the identified addresses and are collaborating with them to recover the stolen funds.
<div>
 <blockquote class="twitter-tweet">
 📢 Update: In response to the cyber attack, we have filed a police complaint and are pursuing additional legal actions. We will keep the community updated as we proceed. » Immediate Actions: We have reported the incident to the Financial Intelligence Unit (FIU) and CERT-In.…— WazirX: India Ka Bitcoin Exchange (@WazirXIndia) <a href="https://twitter.com/WazirXIndia/status/1814250505851588932?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 19, 2024</a>
 </blockquote>
</div>
WazirX is reportedly working with forensic experts and law enforcement agencies to trace the stolen funds and recover customer assets. They are also conducting a thorough analysis of the attack to understand its scope and prevent future breaches.
&nbsp;
WazirX assured its users that it is committed to resolving the situation and is taking all necessary steps to address the breach.&nbsp;
<h2 dir="ltr" id="span-span-insights-from-experts-span-span">Insights from Experts</h2>
Mudit Gupta, Chief Information Security Officer at Polygon Labs,&nbsp;<a style="text-decoration:none" href="https://x.com/Mudit__Gupta/status/1813881385800913327" rel="noopener noreferrer nofollow">suggested</a> that the hackers had been preparing for the attack for over a week. According to Gupta, the hackers upgraded the multisig to a malicious version, enabling them to drain the wallet.&nbsp;
&nbsp;
Blockchain analysts&nbsp;<a style="text-decoration:none" href="https://bsc.news/post/north-korean-hackers-suspected-in-235-m-wazir-x-crypto-heist" rel="noopener noreferrer nofollow">suspect</a> that the Lazarus Group, a notorious North Korean hacking collective, might be behind the attack.

WazirX Reports Breach to FIU, Reaches Out to 500+ Exchanges After $235M Hack

Table of Contents

BSCN

Other articles published on Jul 26, 2024

SEC Approves Grayscale and ProShares Ethereum ETFs for NYSE Arca Listing

SEC Approves Grayscale and ProShares Ethereum ETFs for NYSE Arca Listing

Roxom Unveils Bitcoin-Based Securities Market Backed by Top Investors

Cryptocurrency Investors Experience Market Recovery

Bitcoin Jumps to $67,000 Under Trump’s Shadow

Companies Embrace Bitcoin to Revitalize Their Finances

Join our free newsletter for daily crypto updates!