WazirX: WazirX suffers security breach; $235 million worth of funds moved

Cryptocurrency platform WazirX has suffered the largest cyberattack on an Indian exchange, with hackers reported to have stolen $203 million worth of investor holdings, or more than 40% of the platform’s estimated reserves.Blockchain experts discovered traces of the cybercriminal group Lazarus, allegedly backed by the North Korean government, behind the attack. Lazarus is known for having carried out the world’s largest crypto exchange attacks in the past where the attacked party was not able to recover the funds because the attackers did not engage in negotiations.

“We’re aware that one of our multisig wallets has experienced a security breach,” WazirX said in a statement. “Our team is actively investigating the incident. To ensure the safety of your assets, INR and crypto withdrawals will be temporarily paused,” it said without disclosing the extent of the attack or naming the possible attackers.

“Some preliminary investigations by researchers suggest the Lazarus group was behind the attack,” Aditya Singh, a crypto watcher and influencer, told ET. “If that’s true, the bad news is they do not cooperate, will never be held legally accountable, and are efficient with laundering.”

Lazarus has attacked exchanges and crypto mining marketplaces such as Bithumb, Youbit and Nicehash in the past, he said. Youbit filed for bankruptcy after 17% of its assets were stolen. “The freeze on 50% of WazirX’s assets is a pretty serious situation,” Singh said.

Market watchers believe the incident has the potential to trigger a ripple effect for the Indian crypto industry, which had just begun to resurge from a long winter.

Mudit Gupta, a blockchain security researcher and chief information security officer at OxPolygon Labs, wrote on microblogging site X: “RIP WazirX. Brace for another ‘crypto ban’ in India. Centralised exchanges are literally the opposite of decentralised finance and cryptocurrencies, but the politicians will use this hack to throw dirt at crypto. If you don’t understand it, ban it.”

Meanwhile, WaxirX’s wallet custody service provider Liminal Custody said no breach had happened within its ecosystem.

“Our preliminary investigations show that one of the self-custody multisig smart contract wallets created outside of the Liminal ecosystem has been compromised,” it said in a statement. “We can confirm that Liminal’s platform is not breached and Liminal’s infrastructure, wallets and assets continue to remain safe.”

To contain the panic, WazirX’s rivals including CoinDCX and Mudrex issued advisories that investors’ money was safe in their wallets.

“Our wallet security remains robust,” CoinDCX co founder and chief executive Sumit Gupta wrote in a post on X.

“This incident underscores the importance of continuous monitoring and robust compliance frameworks to protect investors and ensure the integrity of the crypto ecosystem,” Edul Patel, CEO of Mudrex, said in a statement. “Our codebase goes through extensive scrutiny and review at many layers to ensure our tech infrastructure is immune to such exploits.”

According to estimates by research firm Esya Centre, the total crypto assets held by centralized Indian exchanges are worth $13.38 billion.

WazirX, as per its latest proof-of-reserve report, was holding $503 million of assets, marking a 79% surge compared with January 2024.

The breach was first discovered by Web3 security firm Cyvers. “Multiple suspicious transactions” were detected involving WazirX’s Safe Multisig wallet on Ethereum, it said.

According to Cyvers’ post on X, it is believed that $234.9 million of funds in the Safe Multisig wallet were moved to a new address, with each transaction’s caller funded by tornado cash, a fully decentralised protocol for private transactions on Ethereum.