Tornado Cash

Tornado

WazirX

<p class="is-style-lead">The WazirX exploiter has laundered over $64 million via Tornado Cash, as allegations of insider involvement have surfaced.</p> 
<p>According to PeckShieldAlert, on Sep. 13 the WazirX hacker moved 5,000 <a href="https://crypto.news/price/ethereum/" target="_blank">ETH</a>, roughly $11.8 million, to a new address before <a href="https://etherscan.io/address/0xa4d155734f0b704ea5568ce89b687d2285279845" target="_blank">laundering</a> the stolen loot via cryptocurrency mixer Tornado Cash in a bid to obscure the trail.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr"><a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank">#PeckShieldAlert</a> The <a href="https://twitter.com/hashtag/WazirX?src=hash&amp;ref_src=twsrc%5Etfw" target="_blank">#WazirX</a> exploiter-labeled address has moved the 5th batch of 5K <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank">$ETH</a> (worth ~$11.8M) to a new address 0xa4d1…9845, likely preparing to launder them through a mixer. <a rel="" href="https://t.co/7bQu9npzEo" target="_blank">pic.twitter.com/7bQu9npzEo</a></p>— PeckShieldAlert (@PeckShieldAlert) <a href="https://twitter.com/PeckShieldAlert/status/1834441884871377165?ref_src=twsrc%5Etfw" target="_blank">September 13, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<p>With this latest transaction, the attacker has <a href="https://crypto.news/wazirx-hacker-transfers-1600-eth-to-tornado-cash/" target="_blank">laundered</a> about 27,600 ETH, valued at approximately $64.97 million, over the past weeks.</p> 
<p>As the attacker moved the funds, reports surfaced alleging possible insider involvement in the <a href="https://crypto.news/wazirx-halts-trading-closes-deposits-following-235m-attack/" target="_blank">$230 million breach</a> that crippled what was once India’s biggest cryptocurrency exchange.</p> 
<h2 class="wp-block-heading" id="what-are-the-allegations">What are the allegations?&nbsp;</h2> 
<p>An X account named Justice for WazirX Users, citing unnamed sources and data from a First Information Report filed with the Delhi Police, pointed out some unusual activities at the exchange before the hack.</p> 
<p>The allegations <a href="https://x.com/IndiasCrypto/status/1834197121559326877" target="_blank">claim</a> the attacker used fake KYC information to open a WazirX account and deposited cryptocurrency, which was traded for <a href="https://crypto.news/price/gala/" target="_blank">GALA </a>tokens.</p> 
<p>On July 18, the day of the breach, the hacker began withdrawing GALA tokens, which caused the depletion of WazirX’s hot wallet. This forced the exchange to transfer additional GALA tokens from cold storage, managed by its <a href="https://crypto.news/wazirx-shifts-funds-to-new-multisig-wallets-cuts-ties-with-liminal-after-230m-hack/" target="_blank">former custodian Liminal</a>, to replenish the hot wallet.</p> 
<p>During this process, the hacker allegedly injected malicious code, causing the transfer of tokens from cold to hot storage to fail. As subsequent attempts were made by cold storage signatories to move the funds the attacker managed to swipe their credentials in the process.&nbsp;</p> 
<p>Having obtained the necessary signatures, the attacker allegedly used the WazirX team’s login session to initiate a final transaction on Liminal’s platform that upgraded the WazirX cold wallet contract, which ultimately led to the breach.</p> 
<p>“Once these 3 signatures were submitted to Liminal, they provided the final 4th signature, allowing the contract to be upgraded,” JfWU added.</p> 
<p> You might also like: <a rel="" href="https://crypto.news/the-inside-story-of-wazirxs-235m-hack/"> The inside story of WazirX’s $235M hack and how it’s destroying users lives left without answers </a> </p> 
<p>An analysis by Crystal Intelligence confirmed that the laptops of key personnel used for signing transactions were not compromised. A separate audit of Liminal’s system by Grant Thornton also <a href="https://crypto.news/audit-finds-230m-wazirx-hack-originated-outside-liminal-custody/" target="_blank">found no evidence</a> of a custodial breach, leading to more confusion.</p> 
<p>JfWU argued that modifying the cold wallet’s smart contract would have been difficult without insider cooperation, raising suspicions of internal involvement.</p> 
<p>The allegations are yet to be confirmed, but both JfWU and several WazirX customers are <a href="https://x.com/evakeel24/status/1834199403319439446" target="_blank">urging</a> the Central Bureau of Investigation and the Enforcement Directorate to conduct a thorough investigation into the case.</p> 
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper"> 
  <blockquote class="twitter-tweet" data-width="550" data-dnt="true">
   <p lang="en" dir="ltr">Too many red flags, concerns, &amp; malpractices. Everyone handling this both from <a href="https://twitter.com/WazirXIndia?ref_src=twsrc%5Etfw" target="_blank">@WazirXIndia</a> &amp; <a href="https://twitter.com/liminalcustody?ref_src=twsrc%5Etfw" target="_blank">@liminalcustody</a> should be investigated. The whole thing looks like <a href="https://twitter.com/NischalShetty?ref_src=twsrc%5Etfw" target="_blank">@NischalShetty</a> and/or <a href="https://twitter.com/binance?ref_src=twsrc%5Etfw" target="_blank">@binance</a> must be hiding something from its users. Should be investigated by <a href="https://twitter.com/cbic_india?ref_src=twsrc%5Etfw" target="_blank">@cbic_india</a> <a href="https://twitter.com/dir_ed?ref_src=twsrc%5Etfw" target="_blank">@dir_ed</a></p>— HABEEB (@tkhabeeb) <a href="https://twitter.com/tkhabeeb/status/1834213869020971337?ref_src=twsrc%5Etfw" target="_blank">September 12, 2024</a>
  </blockquote>
  <script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
 </div>
</figure> 
<h2 class="wp-block-heading" id="wazirx-s-restructuring-attempt-faces-hiccups">WazirX’s restructuring attempt faces hiccups</h2> 
<p>Amidst this chaos, WazirX’s restructuring process, <a href="https://crypto.news/wazirx-announces-inr-withdrawals-provides-update-for-crypto-holders/" target="_blank">announced</a> on Aug. 28, is facing hurdles as the exchange seeks customer support for a moratorium application under Singapore’s insolvency laws to secure approval from the Singapore court.&nbsp;</p> 
<p>However, the process hit a stumbling block as users <a href="https://x.com/EverythingAjay/status/1834190459721150480" target="_blank">expressed frustration</a> over a poll that initially offered only a “Yes” option to support the application. On Sept. 12, following the backlash, WazirX management expanded the poll to include “No” and “No Position” options, allowing users to voice their opposition or remain neutral on the matter.</p> 
<p>A Sept. 10 affidavit obtained by crypto.news showed that just 441 of WazirX’s 4.4 million users had come out in support of the proposal. A subsequent affidavit confirmed that a hearing on the moratorium application is set for Sept. 25, 2024, in the Singapore High Court.</p> 
<p> Read more: <a rel="" href="https://crypto.news/audit-finds-230m-wazirx-hack-originated-outside-liminal-custody/"> Audit finds $230M WazirX hack originated outside Liminal Custody </a> </p>

WazirX hacker launders over $64m, insider involvement suspected

Table of Contents

crypto.news

Other articles published on Sep 13, 2024

Coinpedia Fintech News

ParaFi Capital Tokenization Launches $1B Fund On Avalanche

Pepe Unchained Emerges As Top Token Presale of 2024, Raising Over $13.1 Million

Robert Kiyosaki Says Neither Trump nor Harris Can Fix the US Debt Crisis

IntelMarkets Leads the Trading Power Shift, ASI Launches on Cardano As Solana Set for Rebound

Pavel Durov Criticizes French Authorities Over Telegram Charges, Hints at Market Withdrawals

Join our free newsletter for daily crypto updates!