WazirX Suspends Withdrawals Following $230 Million Crypto Asset Loss Due to Security Breach

In an unexpected turn of events, major Indian cryptocurrency platform WazirX paused all withdrawals on Thursday following what it characterized as a ‘force majeure’ event, leading to the unfortunate loss of $230 million—a substantial portion of its assets.

The Mumbai-headquartered trading service disclosed that a breach targeted one of its multiple signature—or multisig—wallets, which demand two or more unique keys to authorize transactions. WazirX elaborated that this particular wallet was secured by six signatories, with five being members of the WazirX cadre. Liminal, a wallet infrastructure service, relayed to TechCrunch that preliminary findings indicate a breach in a wallet not generated within its system.

WazirX explained that “the cyber-attack was traced back to an inconsistency between the transaction’s actual composition and the data shown on Liminal’s user interface,” as per their announcement last Thursday. During the attack, the data revealed on Liminal’s interface didn’t match the signed transaction, raising suspicions that the payload was altered to shift wallet control to the perpetrator.

Third-party blockchain analysis service Lookchain pointed out the unauthorized transfer of over 200 cryptocurrency types from the platform, among them 5.43 billion SHIB tokens, upwards of 15,200 Ethereum tokens, close to 20.5 million Matic tokens, around 640 billion Pepe tokens, 5.79 million USDT, and approximately 135 million Gala tokens.

Investigators tracking the blockchain records have observed attempts by the assailants to liquidate the pilfered assets through the decentralized exchange Uniswap. Risk management firm Elliptic claimed the hackers may have links to North Korea.

The cybersecurity incident has profoundly impacted WazirX, with about $230 million in digital assets gone, which was close to half of the sum disclosed in its June proof-of-reserves report.

Rival Indian cryptocurrency exchanges CoinSwitch and CoinDCX reassured their customers, stating their funds were not affected and remain secure.

CoinDCX’s co-founder and CEO Sumit Gupta reinforced confidence in their systems tweeting, “Our wallet security remains robust.”

CoinSwitch’s leadership also chimed in with a cautionary note from CEO Ashish Singhal, stating via tweet for investors “to be aware of potential market volatility during this period and to trade and invest wisely.”

WazirX is navigating through difficult waters since its estrangement from Binance earlier in 2023—a rift that ensued after a contentious public dispute in 2022. Despite Binance announcing its purchase of WazirX two years prior, disagreements over the acquisition culminated with Binance’s CEO Changpeng Zhao declaring that the transaction wasn’t completed and terminating relations with the Indian exchange.

WazirX assured the public through a statement on its X account, “We are undertaking every possible measure to retrieve the funds. We have obstructed certain deposits and engaged with relevant wallet services for recovery. We are collaborating with leading experts to assist us in this quest.”

Updates on the story continued to unfold throughout the day, with the latest amendment at 11.03 pm India Standard Time highlighting WazirX’s admittance to the crypto assets’ loss due to the security breach.