Security Breach at WazirX Cryptocurrency Exchange

On July 18, 2024, WazirX, a prominent cryptocurrency exchange, confirmed a significant security breach leading to the loss of approximately $235 million from one of its multisig wallets. The breach necessitated the temporary suspension of withdrawals in Indian Rupees (INR) and cryptocurrencies, causing concerns within the crypto community.

Incident Overview

WazirX disclosed that the breach targeted a multisig wallet, requiring multiple private keys for transaction authorization. The compromised wallet, utilized since February 2023 with digital asset custody services from Liminal, encountered a breach resulting in a loss exceeding $230 million. This prompted an immediate response from WazirX to secure the remaining assets.

Wallet Configuration and Breach Mechanics

The affected wallet involved six signatories, comprising five from WazirX and one from Liminal. Transactions typically necessitated approval from three WazirX signatories utilizing Ledger Hardware Wallets for enhanced security, followed by final approval from Liminal's representative. Despite these security protocols, the breach occurred due to a discrepancy between data displayed on Liminal's interface and the transaction details, allowing unauthorized control over the wallet through manipulation of the transaction payload.

Response and Recovery Efforts

In the aftermath of the hack, WazirX filed a police complaint and initiated legal actions. The exchange reported the incident to the Financial Intelligence Unit (FIU) and CERT-In, collaborating with over 500 exchanges to block identified addresses and recover stolen funds. WazirX is collaborating with forensic experts and law enforcement agencies to trace stolen funds and recover customer assets, along with conducting a comprehensive analysis of the attack to prevent future breaches. The exchange reassured users of its commitment to resolving the situation and undertaking necessary measures.

Insights from Experts

Mudit Gupta, Chief Information Security Officer at Polygon Labs, indicated that hackers had likely prepared for the attack over a week. Gupta suggested that the hackers upgraded the multisig to a malicious version, facilitating fund drainage. Moreover, blockchain analysts suspect the involvement of the Lazarus Group, a notorious North Korean hacking collective, in the breach.