Indian cryptocurrency exchange Wazirx lost virtual assets worth more than $230 million in a cyber attack believed to be linked to North Korea. The attack targeted a company with a multi-signature wallet system, requiring multiple keys to authorize transactions.
The compromised wallet had six signatories, five from Wazirx and one from Liminal. Transactions on the platform typically required approval from three Wazirx signatories and one Liminal signator. The hackers managed to exploit a loophole between the Liminal interface and actual transaction data to bypass security measures.
Following the attack, Wazirx halted all cryptocurrency withdrawals and blocked certain deposits. The exchange reached out to affected wallet owners to assist in fund recovery. Officials labeled the incident as Force Majeure and assured customers that steps had been taken to safeguard their assets.
Blockchain analytics platform LookIntoChain reported that traces of the stolen assets had been identified, with the perpetrators seeking buyers. Elliptic, a British company specializing in blockchain analytics for regulatory compliance, revealed that the thieves had started exchanging stolen tokens for Ether through decentralized services. Elliptic linked the criminals to North Korea, which allegedly uses cryptocurrencies to evade international sanctions and fund its nuclear program.
Wazirx, a major cryptocurrency exchange in India with 16 million users, was acquired by Binance in 2019, a move that sparked disagreements between the parties. While Binance founder Chanpen Zhao claims the acquisition was incomplete, Wazirx co-founder Nischal Shetty insists otherwise.
The association with Binance brought additional challenges for Wazirx. In December 2023, Binance operations in India were suspended due to money laundering rule violations. The platform only resumed operations last month after paying a $2.25 million fine.
Wazirx has also faced regulatory issues in India. In August 2022, the company had $8.1 million frozen as part of a money laundering investigation.
Despite ongoing discussions, India has yet to reach a final decision on banning or restricting cryptocurrencies. Joanna Chang from Fireblocks highlighted the lack of clear regulations in India’s cryptocurrency industry, which poses uncertainties and risks for both businesses and users.