India's largest cryptocurrency exchange, WazirX, has suffered a major security breach resulting in the theft of over $230 million in digital assets. causing the loss of user funds. WazirX, which popularly calls itself as 'India Ka Bitcoin Exchange' confirmed. #WazirXHack#wazirx
At WazirX, our commitment to transparency and community welfare is paramount. There was a cyber attack on one of our multisig wallets. Below are the preliminary findings to clarify the situation:
» Incident Overview: A cyber attack occurred in one of our multisig wallets involving a loss of funds exceeding $230 million. This wallet was operated utilizing the services of Liminal's digital asset custody and wallet infrastructure from February 2023.
» Wallet Configuration and Breach Mechanics: The wallet had six signatories—five from our WazirX team and one from Liminal, who were responsible for transaction verifications. A transaction typically requires approval from three of the WazirX signatories (all three of whom use Ledger Hardware Wallets for security), followed by the final approval from Liminal's signatory. A policy to whitelist destination addresses was also in place to enhance security. These whitelisted addresses were earmarked and facilitated on the interface by Liminal; consequently, the WazirX team had the ability to initiate transactions to the said whitelisted addresses.
» Nature of the Cyber Attack: The cyber attack stemmed from a discrepancy between the data displayed on Liminal's interface and the transaction's actual contents. During the cyber attack, there was a mismatch between the information displayed on Liminal’s interface and what was actually signed. We suspect the payload was replaced to transfer wallet control to an attacker.
» Security Measures and Response: We had robust security features, including the Gnosis Safe multisig smart contract platform and Liminal’s whitelisting policy. Despite us taking all necessary steps to protect the customer assets, the cyber attackers appear to have possibly breached such security features, and the theft occurred.
This is a force majeure event beyond our control, but we are leaving no stone unturned to locate and recover the funds. We have already blocked a few deposits and reached out to concerned wallets for recovery. We are in touch with the best resources to help us in this endeavor. While these are our findings from our preliminary investigation, we will keep you posted with further updates. Together with your support, we shall overcome this challenge and emerge stronger and more resilient than ever.
Thank you for standing with us 🙏
Affected WazirX Wallet Address: 0x27fD43BABfbe83a81d14665b1a6fB8030A60C9b4
📢 Update: In response to the cyber attack, we have filed a police complaint and are pursuing additional legal actions. We will keep the community updated as we proceed.
» Immediate Actions: We have reported the incident to the Financial Intelligence Unit (FIU) and CERT-In. We're reaching out to 500+ exchanges to block the identified addresses. Many exchanges are cooperating with us, and we are actively working with them on additional resources to aid our recovery efforts.
» Plan of Action: Our immediate plans include tracing the stolen funds, recovering customer assets, and conducting a deeper analysis of the cyber attack. We are collaborating with forensic experts and law enforcement agencies to identify and apprehend the perpetrators.
Thank you for your patience and understanding. We’ll keep you posted with further updates 🙏