WazirX Suspends Withdrawals Following $230 Million Loss, Almost 50% of Its Reserves Depleted

On Thursday, WazirX, a prominent cryptocurrency exchange in India, announced the suspension of withdrawals following a security incident they referred to as a “force majeure event,” which led to a staggering loss of $230 million, essentially depleting nearly half of its assets.

According to the Mumbai-based company, the breach targeted one of its multisig wallets, which necessitates the use of two or more private keys to authorize transactions. WazirX disclosed that this particular wallet was secured by six signatories, five of whom were part of the WazirX team. Liminal, a company that provides wallet infrastructure services, conveyed to TechCrunch that initial findings indicated the breach involved a wallet not within its secure ecosystem.

WazirX explained, in a public statement, that the cyber-attack originated from a discrepancy in data shown on Liminal’s user interface versus the actual transaction details. “There was a disparity between what Liminal’s interface showed and the transaction that was executed. It appears the transaction payload was altered to redirect control of the wallet to an external party,” WazirX stated.

Third-party blockchain analysis service Lookchain uncovered that the theft involved over 200 types of cryptocurrencies, including 5.43 billion SHIB tokens, more than 15,200 Ethereum tokens, 20.5 million Matic tokens, 640 billion Pepe tokens, 5.79 million USDT, and 135 million Gala tokens from the exchange.

Blockchain analysis shows attempts by the culprits to liquidate the stolen assets through the decentralized exchange platform Uniswap. Elliptic, a risk management firm, has linked the hacking activity to North Korean affiliates.

The lost $230 million represents a significant chunk of WazirX’s declared $500 million reserves reported in their June verification of reserves publication.

In light of this event, fellow Indian cryptocurrency platforms CoinSwitch and CoinDCX have reassured their customers, affirming the safety and security of their deposits despite the incident.

CoinDCX’s co-founder and CEO, Sumit Gupta, emphasized the integrity of their wallet’s security in a recent tweet.

Ashish Singhal, co-founder and CEO of PeepalCo, the parent company of CoinSwitch, advised crypto investors via Twitter to stay vigilant of possible market fluctuations during this period and to trade cautiously.

This event marks a significant challenge for WazirX, which had already experienced a turbulent separation from Binance earlier in 2023, following a widely publicized dispute over ownership that initiated two years after Binance’s acquisition announcement. Their relationship was further complicated when Binance’s Changpeng Zhao declared the acquisition incomplete and consequently ceased operations with the Indian exchange.

“Despite the unforeseen nature of this event, our team is fully engaged in efforts to trace and recover the lost funds. We have already halted some deposits and are coordinating with the relevant wallet services to facilitate recovery. Our team is working diligently with top experts in the field to address this issue,” WazirX stated in an update on its X account.

Updates were made to this report throughout the day, the latest at 11:03 p.m. India Standard Time, confirming the loss of crypto assets as a result of the security breach, as per WazirX’s announcement.