The Chronology of the Alleged WazirX Hack

By Chetna Gill

On July 18, 2024, India-based cryptocurrency exchange WazirX was hit by a significant security breach, resulting in the loss of approximately $234.9 million (about ₹2,000 crore) of investor funds. The attack, carried out by North Korean hackers associated with the Lazarus Group, exploited vulnerabilities within WazirX's systems. The hackers transferred the stolen assets to a new address, effectively siphoning off investor funds. On the very same day, WazirX was forced to cease operations and suspend all crypto trading, a critical turning point that deeply impacted the exchange and its users. 
The hack was executed through a highly sophisticated approach that targeted WazirX's multi-signature (multi-sig) wallet. This wallet, managed by a combination of five WazirX signatories and one Liminal signatory, required specific approvals to initiate transactions. The attackers created a fake account, deposited tokens, and initiated Gala (GALA) token purchases. After emptying the hot wallet, they gained access to the cold wallet. Once WazirX signatories interacted with the multi-sig wallet, the hackers altered the intelligent contract controlling it, granting themselves unrestricted access to all the funds. Prior to the attack, WazirX had publicly disclosed holding approximately $500 million in digital assets as of June 2024, underscoring the scale of the impact caused by the breach.
On August 27, WazirX's Singapore-registered parent company, Zettai Pte Ltd, took a significant step in its legal process. It filed an application with the High Court of Singapore for a six-month moratorium to prevent creditors from taking legal action while it restructures its liabilities. This filing, as per Singapore law, automatically initiates a 30-day moratorium, during which the court reviews the request.WazirX has made it clear that the dispute between Zettai and Binance is far from over. They noted that "[o]nly after this dispute is resolved can there be clarity over the ownership of the Platform and its cryptocurrency tokens (which Zettai now holds albeit under protest after Binance relinquished control of these tokens)." The ownership dispute, which began in 2019 when Binance announced its acquisition of WazirX, is still ongoing.
However, in August 2022, Binance and its China-born Canadian founder Changpeng Zhao (CZ) made a surprising turn by denying their previous ownership claims after Indian authorities froze WazirX's assets under suspicion of money laundering. CZ asserted that the acquisition was never finalized, a statement contested by WazirX CEO Nischal Shetty, who shared emails indicating Binance had pressured him to deny any affiliation. The conflicting claims have added a new layer of complexity to the issue, leaving it unresolved.
On September 17, Binance released a blog post accusing WazirX and Shetty, of continuing to mislead both customers and the market about the relationship between WazirX and Binance. Binance asserted that it has never owned, controlled, or operated WazirX, whether before, during, or after the July 2024 security breach.
Binance further stated that there is no legal basis for any claim suggesting it is liable for issues involving Zettai. The post accused Shetty of implying Binance's liability because Binance had requested the removal of WazirX user funds from its wallets. Binance maintains that it had given ample notice for WazirX user funds to be removed well before the hack took place, which Shetty's team complied with. Additionally, Binance suggested the possibility of an internal issue, noting that it "has not been able to verify the alleged cyber-attack" and that WazirX has not provided its internal reports on the incident despite Binance's request.
On September 18, the suspected North Korean hackers behind the July 18 attack transferred another batch of 5,000 ETH tokens through the Ethereum-based mixing service Tornado Cash. These tokens are approximately $12 million, a portion of the estimated $235 million stolen in the heist. This was the third such transfer this week, bringing the total to eight since the incident. Since the hack, which resulted in losing about 45% of its digital assets, WazirX has faced difficulties stabilizing its operations. Without sufficient funds to restore customer accounts to their pre-hack state, the exchange proposed a "socialized loss strategy," allowing partial recovery of customer balances. This move has understandably led to frustration among customers, who question why they should bear the consequences of the exchange's security failures.

At the time of writing this chronological report, the founders of WazirX are facing backlash for announcing the formation of a completely opaque Committee of Creditors (COC) to represent creditors' interests in their engagement with the company. Ironically, WazirX users cannot nominate committee members. Additionally, they have reportedly been meeting with eight to ten officials from various Indian government agencies, including the Financial Intelligence Unit (FIU), the Intelligence Bureau (IB), and the Indian Computer Emergency Response Team (CERT-In). These officials are seeking information about the recent hack and theft of cryptocurrency tokens from WazirX wallets, a situation that has had a devastating impact on the platform.

IndraStra Global is now available on
Apple News, Google News, Feedly, Flipboard, and  WhatsApp Channel

COPYRIGHT: This article is published under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. https://creativecommons.org/licenses/by-nc-nd/4.0/

REPUBLISH: Republish our articles online or in print for free if you follow these guidelines. https://www.indrastra.com/p/republish-us.html