WazirX Heist: Fallout from India's Biggest Crypto Hack

One of India’s largest cryptocurrency exchanges experienced a massive $230 million heist on July 18, 2024. The stolen crypto accounted for almost 50% of WazirX’s total assets. Funds were frozen and investor confidence was shattered.

The incident sent shockwaves throughout the crypto industry as a whole, and is bound to have a profound effect on India’s crypto policy. The incident came at an inopportune time as India’s government and regulatory agencies were fighting over the direction of cryptocurrency in the country moving forward.

While these security breaches create financial loss and uncertainty in the short term, ultimately the crypto industry as a whole can become more stable in the next phase of maturation. As Binance Head of Regional Markets Vishal Sacheendran explains, “At the end of the day, a hack on one of our own people within the industry is a hack on the entire industry. Everyone takes a hit, not just the users but also the regulators and the critics of crypto. It’s an opportunity for us to come together, rebuild trust, and show that we are capable of helping each other. This year alone, Binance has helped recover over $80 million in stolen funds, and we've helped prevent billions in fraud. It's all about collaboration and education, because as an industry, we grow stronger when we work together."

The WazirX Hack: What Happened

The WazirX Ethereum hot wallet was drained by a sophisticated hack. Using social engineering and exploiting multi-signature wallet protocols, the attacker bypassed security safeguards. These wallets, which require multiple approvals for transactions, were compromised when the hacker obtained the necessary signatures. Here’s a diagram by Crystal Intelligence showing how multi-signatory systems work.

WazirX required multiple private keys to authorize transactions. Four out of the six signatures were needed, three from users and one from its custodian Liminal. The attacker’s social engineering tactics convinced multiple signatories to approve a transaction but instead rerouted funds to the attacker’s wallets. They quickly laundered the funds to remove them from the WazirX platform.

The attack resulted in the loss of about half of WazirX’s reserves, including $100 million in Shiba Inu tokens and $52 million in Ether. Despite robust security measures, the breach exposed critical flaws in custody protocols and impacted hundreds of thousands of users. With access, it’s believed the hackers manipulated existing smart contracts, altering the underlying conditions to further bypass security measures and allow them to execute unauthorized transactions.

The Fallout

WazirX temporarily froze trading and withdrawals, leaving users stranded and fear among crypto users. Many questioned the platform’s crisis management, particularly its communication with users and slow recovery efforts.

This incident also highlighted the broader risks inherent in cryptocurrency exchanges, particularly those operating in emerging markets with less regulatory oversight.

The Laundering of Stolen Funds

The hacker laundered the stolen funds using Tornado Cash, a privacy-focused mixing service. By pooling transactions, Tornado Cash obscures the origin and destination of funds, making it a favored tool among cybercriminals and a target of regulators. The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has sanctioned Tornado Cash for repeatedly failing to impose effective controls to stop laundering funds.

Regardless, by late September 2024, almost all stolen assets had been laundered, with just $6 million remaining in the hacker's wallet.

Lessons Learned and Industry Implications

The WazirX hack offers several critical takeaways for the cryptocurrency industry:

• Improved Security Protocols: Multi-signature wallets alone are not sophisticated enough to secure crypto funds.

• Real-Time Monitoring: Exchanges need advanced blockchain analytics tools to detect suspicious activities early and mitigate potential damage

• Transparency During Crises: Clear and timely communication is crucial for maintaining user trust during incidents

On a broader scale, the hack underscores the need for global collaboration in regulating and securing the crypto ecosystem.

In November 2024, WazirX co-founder Nischal Shetty said it planned to launch a decentralized exchange (DEX) to enhance security. “With a decentralized exchange, assets remain fully in users’ control, free from counter-party risks,” he said during a town hall video.

An open-source, non-custodial, decentralized exchange is a more secure way to protect assets. A decentralized platform allows users to trade cryptocurrencies directly with one another, eliminating intermediaries. However, users maintain full control of their private keys and wallets, which significantly enhances security. Transactions are executed on-chain, providing transparency and an auditable record of activities. This is how Binance, the world’s largest crypto exchange operates.

Wake Up Call for the Crypto Industry (and Regulators)

The WazirX heist was a wake-up call for the crypto industry, particularly in emerging markets like India. It exposed glaring vulnerabilities and emphasized the need for more robust security protocols.

Incidents like this are also catching the attention of regulators and government agencies. The Securities and Exchange Board of India (SEBI) has proposed a multi-regulatory framework for overseeing cryptocurrency activities — creating a more structured regulatory environment.

In most countries, there is a lack of comprehensive legislation regarding crypto. In the U.S., the SEC oversees some crypto assets that it deems are securities. CFTC focuses on commodities and derivatives. Attempts at legislation to clarify roles and offer consumer protection have been introduced, but have not passed.

With no federal framework in place, state laws take precedence. States like New York and California have enacted or are developing specific cryptocurrency regulatory regimes. These initiatives focus on licensing, consumer protection, and anti-money laundering (AML) measures. Yet, most states have no particular crypto-specific laws in place.

Invest Wisely

Crypto investing relies on investor confidence. High-profile (and high-dollar) hacks undermine that confidence. Before you make any investment, you need to be comfortable that the platform you’re using is taking the right security measures for your protection.

This article does not necessarily reflect the opinions of the editors or management of EconoTimes.