LayneMatos1 at 22:12, 28 April 2026

2026-04-28T22:12:46Z

New page

{{Short description|Cyberattack and cryptocurrency theft}}
{{Infobox event
| date = July 18, 2024
| type = [[Cyberattack]]; cryptocurrency theft
| outcome = Approx. US$230–235 million stolen; withdrawals and trading suspended
| suspects = Attributed to the [[Lazarus Group]]
| target = WazirX
}}
On 18 July, 2024, WazirX, an Indian [[cryptocurrency exchange]], reported a cyberattack in which approximately US$234.9 million (around ₹2,000 crore) in digital assets were stolen from a [[Multisignature wallet|multi-signature wallet]] used under a third-party custody arrangement with Liminal Custody.<ref>{{cite web |last1=Venugopal |first1=Sahana |date=3 September 2024 |title=WazirX Cyberattack: What is WazirX's legal status after a $230 million wallet hack? |url=https://www.thehindu.com/sci-tech/technology/what-is-wazirxs-legal-status-after-a-230-million-wallet-hack/article68595715.ece |work=[[The Hindu]] |language=en-IN}}</ref><ref>{{Cite web |date=2024-07-18 |title=WazirX cryptocurrency exchange halts withdrawals after security breach |url=https://indianexpress.com/article/india/wazirx-cryptocurrency-withdrawals-security-breach-9461946/ |access-date=2024-07-31 |website=The Indian Express |language=en}}</ref> Global analysis later linked the attack to the [[Lazarus Group]], a North Korea–associated threat actor targeting crypto infrastructures worldwide.<ref>{{Cite web |title=Joint Statement on Cryptocurrency Thefts by the Democratic People’s Republic of Korea and Public-Private Collaboration |url=https://2021-2025.state.gov/office-of-the-spokesperson/releases/2025/01/joint-statement-on-cryptocurrency-thefts-by-the-democratic-peoples-republic-of-korea-and-public-private-collaboration/ |access-date=2026-02-26 |website=United States Department of State |language=en}}</ref>

== Hack ==
On 18 July 2024, $234.9 million worth of crypto assets have been taken out of the exchange and sent to a new address by North Korean hackers belonging to [[Lazarus Group]].<ref>{{Cite news |last=Shukla|first=Siddharth|date=2024-07-18|title=WazirX Pauses Crypto, Rupee Withdrawals After Wallet Breach|url=https://www.bloomberg.com/news/articles/2024-07-18/wazirx-pauses-crypto-rupee-withdrawals-after-wallet-breach-lyqzzwm1|access-date=2024-07-31|work=Bloomberg.com|language=en}}</ref><ref>{{Cite web |last=Anand|first=Vijay|date=2024-07-29|title=North Korean Lazarus Group linked to $235 million WazirX crypto breach - CNBC TV18|url=https://www.cnbctv18.com/technology/wazirx-crypto-breach-cyfirma-north-korean-lazarus-group-19450904.htm|access-date=2024-07-31|website=CNBCTV18|language=en}}</ref>

=== Modus operandi ===
WazirX's [[multisig]] [[Cryptocurrency wallet|wallet]], controlled by five WazirX and one Liminal signature, required three WazirX and one Liminal signature to initiate transactions. Hackers created a fake WazirX account, deposited tokens, and began purchasing Gala (GALA) tokens. After draining the [[hot wallet]], they accessed the [[cold wallet]]. When WazirX signatories accessed the multisig wallet, the hackers altered the smart contract controlling it. Once modified in their favor, the attackers gained full control, no longer needing WazirX's keys, and drained all the funds.<ref>{{Cite web |last=Anupam|first=Suprita|date=2024-09-25|title=The End Of WazirX: The $234 Mn Heist, Nischal Shetty Under Fire And The Blame Game|url=https://inc42.com/features/wazirx-crypto-heist-nischal-shetty-blame-game/|access-date=2024-09-26|website=Inc42 Media|language=en}}</ref> Before the attack, the crypto exchange stated in its June 2024 proof-of-reserves disclosure that it had about $500 million in digital assets.<ref>{{Cite news |last=|first=|date=2024-07-29|title=WazirX crypto exchange hack: how much of the assets was lost, CEO Nischal Shetty's announcement, and what happens next|url=https://www.thehindu.com/sci-tech/technology/wazirx-crypto-exchange-hack-how-much-of-the-assets-was-lost-and-what-happens-next/article68459460.ece|access-date=2024-07-31|work=The Hindu|language=en-IN|issn=0971-751X}}</ref>

=== Exchange closure ===
On 18 July 2024, the exchange suspended crypto trading by disclosing the incident.<ref>{{Cite web |last=Singh|first=Manish|date=2024-07-21|title=WazirX halts trading after $230 million 'force majeure' loss|url=https://techcrunch.com/2024/07/21/wazirx-halts-trading-after-230-million-hit-to-crypto-exchange/?guccounter=1&guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_sig=AQAAAEqQb3DWP_YrVKDE1Q-eSYG-fqRWZTsj8fXpaIkOtiq_BnXD9WNfAgJR9Xl6ysmU0W_KRakHLRgKg3SdcdKqLbS08NUaD7vsgbLSIPzlekFATRNS5ZjQfFb1hPEc1PCWFdanjXZ9m0W5qwu5fR2axTOfFadiT_W_jEI-auYNXKgZ|access-date=2024-08-31|website=TechCrunch|language=en-US}}</ref><ref>{{Cite web |last=Sharma|first=Manoj|date=2024-07-10|title=WazirX halts trading, announces $23 mn bounty after hackers steal $234 mn. Key updates|url=https://www.fortuneindia.com/macro/wazirx-halts-trading-announces-23-mn-bounty-after-hackers-steal-234-mn-key-updates/117654|access-date=2024-08-31|website=www.fortuneindia.com|language=en}}</ref> User balances were reset to 18 July 2024 (1:00 PM IST), reversing trades made after the hack. This followed user protests after WazirX froze some funds, halted withdrawals, and proposed spreading losses across all users.<ref>{{Cite news |last= |first= |date=2024-08-09 |title=WazirX CEO Nischal Shetty shares move to restore account balances and undo all platform trades post-withdrawal halt |url=https://www.thehindu.com/sci-tech/technology/wazirx-ceo-nischal-shetty-shares-move-to-restore-account-balances-and-undo-all-platform-trades-post-withdrawal-halt/article68504503.ece |access-date=2026-03-28 |work=The Hindu |language=en-IN |issn=0971-751X}}</ref> A [[First information report|First Information Report]] (FIR) was filed with the Special Cell in New Delhi. One individual, SK Masud Alam, was arrested for opening a "mule" account (under the alias Souvik Mondal) that facilitated the hack.<ref>{{Cite news |last=Singh |first=Navdeep |date=2024-07-18 |title=WazirX temporarily suspends crypto deposits and withdrawals after $230M hack |url=https://economictimes.indiatimes.com/markets/cryptocurrency/wazirx-temporarily-suspends-crypto-deposits-and-withdrawals-after-230m-hack/articleshow/111834527.cms |access-date=2026-02-26 |work=The Economic Times |issn=0013-0389}}</ref><ref>{{Cite web |last=Singh |first=Manish |date=2024-07-21 |title=WazirX halts trading after $230 million 'force majeure' loss |url=https://techcrunch.com/2024/07/21/wazirx-halts-trading-after-230-million-hit-to-crypto-exchange/ |access-date=2026-02-26 |website=TechCrunch |language=en-US}}</ref>

== Investigation ==
According to a report by [[Mandiant]] dated 14 August, WazirX’s cyberattack originated from Liminal Custody which was a Singapore-based security partner of the crypto exchange.<ref>{{Cite web |last=Singh |first=Divyesh |date=2024-09-09 |title=Crypto firm WazirX's security partner says no evidence of cyberattack on its system |url=https://www.indiatoday.in/business/story/wazirx-security-partner-liminal-company-cyberattack-security-breach-audit-findings-2596809-2024-09-09 |access-date=2026-02-26 |website=India Today |language=en}}</ref>As per the report, the attack did not affect the exchange’s hot wallets or primary trading platform infrastructure and was confined to the externally managed multisig custody environment. Liminal Custody disputed aspects of the forensic methodology and conclusions<ref>{{cite web |author=Radhika Parashar & Siddharth Suvarna |date=29 July 2024 |title=WazirX Wallet Hack: Liminal Denies Responsibility Amid Recent Allegations |url=https://www.gadgets360.com/cryptocurrency/news/liminal-refutes-responsibility-wazirx-hack-recent-allegations-6212869 |access-date=26 February 2026 |website=Gadgets360 |publisher=NDTV}}</ref> and they commissioned [[Grant Thornton]] for a comprehensive review of their frontend, backend, UI, and transaction workflow. As per their report, of the 240,000 wallet addresses WazirX submitted to the Singapore court, only a handful were warm/cold wallets managed through Liminal and majority of them had zero balance<ref>{{Cite web |date=20 October 2024 |title=WazirX Shares 2.4 Lakh Non-Zero Fund Crypto Addresses but Investigators Say They’re Lying |url=https://www.binance.com/en/square/post/15129385610761 |access-date=2026-03-29 |website=[[Binance]]}}</ref>; the vast majority were hot wallets controlled directly by WazirX. They drew a direct parallel to the Radiant Capital hack (same attack vector: compromised signer devices, Ledger, UI mismatch and malicious contract upgrade), noting that Radiant took full transparency and accountability while WazirX did not.<ref>{{Cite news |last= |first= |date=2024-10-24 |title=WazirX accused of running “persistent disinformation campaign” by Liminal while users wait for court updates |url=https://www.thehindu.com/sci-tech/technology/wazirx-accused-of-running-persistent-disinformation-campaign-by-liminal-while-users-wait-for-court-updates/article68786444.ece |access-date=2026-03-29 |work=The Hindu |language=en-IN |issn=0971-751X}}</ref>

However, investigative developments in India added further scrutiny to the custody provider’s response. Reports related to the incident noted that the Delhi Police's Intelligence Fusion and Strategic Operations (IFSO) unit alleged that Liminal failed to provide critical logs and technical data associated with the date of the breach. While responses were submitted, authorities stated that the required technical information was not fully provided.<ref>{{Cite web |last= |first= |date=2024-11-14 |title=WazirX Cyberattack: Liminal Responds To Claims Of Non Cooperation; Here's What It Said |url=https://news.abplive.com/business/crypto/wazirx-cyberattack-liminal-responds-to-claims-of-non-cooperation-here-s-what-it-said-1731266 |access-date=2026-02-26 |website=ABP Live |language=en}}</ref><ref>{{Cite web |title=Indian police arrest suspect in $230 million WazirX crypto exchange hack |url=https://therecord.media/wazirx-crypto-exchange-hack-suspect-arrested-india |access-date=2026-02-26 |website=therecord.media |language=en}}</ref>

WazirX terminated its custody agreement with Liminal, and began moving assets to other secure institutional partners.<ref>{{Cite news |last=Singh |first=Navdeep |date=2024-08-14 |title=WazirX ends custody deal with Liminal, begins migration of funds to new wallets after $230 million hack |url=https://economictimes.indiatimes.com/markets/cryptocurrency/wazirx-ends-custody-deal-with-liminal-begins-migration-of-funds-to-new-wallets-after-230-million-hack/articleshow/112527520.cms?from=mdr |access-date=2026-02-26 |work=The Economic Times |issn=0013-0389}}</ref>

== Aftermath ==
On 13 October 2025, the [[High Court of Singapore]] sanctioned (with modifications) a creditor-approved restructuring scheme submitted by Zettai Pte Ltd., WazirX’s Singapore-based entity, after the proposal was supported by about 95.7% of creditors by number and 94.6% by value.<ref>{{Cite web |title=WazirX News: Singapore Clears Plan for Restart, Bringing Respite to Victims of $230M Hack |url=https://www.coindesk.com/markets/2025/10/13/wazirx-restructuring-cleared-in-massive-relief-for-usd230m-hack-victims |access-date=2026-02-26 |website=www.coindesk.com |language=en}}</ref> The [[scheme of arrangement]] was pursued under Singapore’s Insolvency, Restructuring and Dissolution Act 2018 and included steps to restructure liabilities, pro-rata distribution of rebalanced assets (approx. 85 % of claim value), and issuance of Recovery Tokens (RTs) for potential future distributions.<ref>{{Cite web |title=WazirX’s Revival - an understated moment for India’s Crypto Industry? |url=https://m.economictimes.com/wealth/invest/wazirxs-revival-an-understated-moment-for-indias-crypto-industry/amp_articleshow/125462692.cms |access-date=2026-02-26 |website=m.economictimes.com}}</ref> Following the court sanction, the endorsed scheme was filed with Singapore’s [[Accounting and Corporate Regulatory Authority]] (ACRA).<ref>{{Cite web |title=WazirX to reopen within 10 business days after Singapore High Court approval |url=https://news.superex.com/articles/6047.html |access-date=2026-02-26 |website=Superex |language=en-US}}</ref>

During the restructuring process, WazirX continued court proceedings and creditor engagement, including a creditor vote reported as showing high participation and renewed support for the restructuring scheme after an earlier proposal was rejected by the [[Supreme Court of Singapore|Singapore court]].<ref>{{Cite news |last= |first= |date=2025-08-19 |title=WazirX users vote again to support restructuring scheme after Singapore court struck down the first proposal |url=https://www.thehindu.com/sci-tech/technology/wazirx-users-vote-again-to-support-restructuring-scheme-after-singapore-court-struck-down-the-first-proposal/article69950414.ece |access-date=2026-02-26 |work=The Hindu |language=en-IN |issn=}}</ref> The exchange later resumed operations under revised custody arrangements and implemented additional security measures, including the use of institutional custody providers such as [[BitGo]].<ref>{{Cite web |last=V |first=Decrypt / Vismaya |date=2025-10-23 |title=WazirX to Resume Trading and Withdrawals More Than a Year After $234M Hack |url=https://decrypt.co/345632/wazirx-to-resume-trading-and-withdrawals-more-than-a-year-after-234m-hack |access-date=2026-02-26 |website=Decrypt |language=en-US}}</ref><ref>{{Cite news |title=Watch: WazirX founder Nischal Shetty candid on the aftermath of 234M hack |url=https://www.thestreet.com/crypto/markets/watch-wazirx-founder-nischal-shetty-candid-on-the-aftermath-of-234m-hack |archive-url=http://web.archive.org/web/20251227125035/https://www.thestreet.com/crypto/markets/watch-wazirx-founder-nischal-shetty-candid-on-the-aftermath-of-234m-hack |archive-date=2025-12-27 |access-date=2026-02-26 |work=TheStreet Crypto: Bitcoin and cryptocurrency news, advice, analysis and more |language=en}}</ref>

=== Exchange restart ===
After the restructuring scheme became legally effective, WazirX restarted operations on 24 October 2025, and returned 85% funds to users. The platform introduced a temporary 0% trading-fee offer.<ref>{{Cite news |date=2025-10-23 |title=India's crypto exchange WazirX to resume operations on October 24 with 0% trading fees |url=https://timesofindia.indiatimes.com/technology/tech-news/wazirx-to-resume-operations-on-october-24-with-0-trading-fees/articleshow/124759623.cms |access-date=2026-02-26 |work=The Times of India |issn=0971-8257}}</ref> Platform operations resumed with the exchange migrating custody to global crypto institutional custody providers such as [[BitGo]].<ref>{{Cite web |title=WazirX resumes operations, looks to rebuild trust - The Economic Times |url=https://m.economictimes.com/tech/technology/wazirx-resumes-operations-looks-to-rebuild-trust/amp_articleshow/124886580.cms |access-date=2026-02-26 |website=m.economictimes.com}}</ref><ref>{{Cite web |last=Sanzgiri |first=Vallari |date=2025-03-13 |title=WazirX Partners with BitGo Trust to enhance security funds |url=https://www.thehindubusinessline.com/money-and-banking/cryptocurrency/wazirx-partners-with-bitgo-trust-to-rebuild-user-trust/article69321066.ece |access-date=2026-02-26 |website=BusinessLine |language=en}}</ref><ref>{{Cite web |last=Sharma |first=Manoj |date=2025-11-05 |title=After restructuring and restarting post hack, WazirX is now rebuilding to reclaim No. 1 spot: Nischal Shetty |url=https://www.fortuneindia.com/business-news/after-restructuring-and-restarting-post-hack-wazirx-is-now-rebuilding-to-reclaim-no-1-spot-nischal-shetty/127922 |access-date=2026-02-26 |website=Fortune India |language=en}}</ref>

== References ==
{{reflist}}

== Further reading ==
* {{cite book |editor-last1=Mishra |editor-first1=Durgesh |editor-last2=Yang |editor-first2=Xin She |editor-last3=Unal |editor-first3=Aynur |editor-last4=Jat |editor-first4=Dharm Singh |chapter=Building Resilient Cryptocurrency Ecosystems: Lessons from Cyberattacks and the Role of Blockchain and AI |chapter-url=https://books.google.co.in/books?id=2i6KEQAAQBAJ&pg=PA174 |last1=Bhandari |first1=Ravi Baijulal |last2=Ramteke |first2=Neha |last3=Kankariya |first3=Rajkumar |last4=Salunkhe |first4=Harshal Anil |last5=Raidas |first5=Abhishek |last6=Lohar |first6=Ameya |title=Data Science and Big Data Analytics: Proceedings of IDBA 2025, Volume 2 |publisher=[[Springer Nature]]|year=2025 |pages=174–186 |url=https://books.google.co.in/books?id=2i6KEQAAQBAJ}}
* {{cite journal |last1=Chaudhari |first1=Deepesh |last2=Shukla |first2=Sandeep |title=Blockchain-Based Secure Framework for Cryptocurrency Exchange Systems |journal=2024 6th Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS), [[IEEE Access]] |year=2024 |publisher=IEEE |url=https://ieeexplore.ieee.org/abstract/document/10732611}}
* {{cite journal |last1=Seerwani |first1=Prerna |last2=Mohan |first2=M. P. Ram |title=Virtual Digital Assets Service Providers under Indian Insolvency Framework |journal=IIM Ahmedabad Working Paper |publisher=[[Indian Institute of Management Ahmedabad]] |date=2025-10-01 |url=https://www.iima.ac.in/hindi/sites/default/files/2025-10/WP%20No.2025-10-01.pdf}}
* {{cite journal |last=Jithesh |first=A |title=The Great WazirX Hack: A Crypto Killer? |journal=Case House of IIM Raipur |publisher=[[Indian Institute of Management Raipur]]|date=2025-02-17 |url=https://casehouse.iimraipur.edu.in/admin/uploads/CHIRP_86110_CA.pdf}}

{{authority control}}

{{Hacking in the 2020s}}

[[Category:Cryptocurrency theft]]
[[Category:Robberies in India]]
[[Category:2020s in hacking]]
[[Category:Cybercrime in India]]
[[Category:Cyberattacks]]
[[Category:2024 in Indian economy]]
[[Category:India–North Korea relations]]
[[Category:2024 in economic history]]
[[Category:2024 crimes in India]]
[[Category:Cyberwarfare in North Korea]]
[[Category:July 2024 crimes in Asia]]

2024 WazirX hack - Revision history

LayneMatos1 at 22:12, 28 April 2026