Unknown Threat Actors Exploited Discrepancy In Liminal’s Interface To Steal $230 Million From WazirX Multisig Wallet On 14 July 2024 · 14.07.2024
On 14 July 2024, Indian cryptocurrency exchange WazirX suffered a major security breach involving one of its multi-signature wallets, resulting in the loss of over $230 million. WazirX noted that the affected wallet, operational since February 2023, used Liminal's digital asset custody and wallet infrastructure and had six signatories - five from WazirX and one from Liminal. The attackers exploited a discrepancy between the data shown on Liminal’s interface and the actual transaction contents, allowing them to replace the transaction payload and gain control of the wallet. Liminal stated that the compromised wallet was not under its custody. Despite robust security measures, including the Gnosis Safe multisig smart contract platform and a whitelisting policy, the breach occurred. WazirX halted withdrawals, launched recovery efforts, and is working with authorities and blockchain security firms. The incident was publicly announced on 18 July 2024. Blockchain data suggests that the attackers are attempting to sell assets via the decentralised exchange Uniswap, with speculation that the hack may have stemmed from North Korea.
Sources cited by EuRepoC (30)
Show 25 more
WazirX · last year (2024)
The United States and Republic of Korea additionally attribute to the DPRK, based on detailed industry analysis, thefts last year against WazirX for $235 million and Radiant Capital for $50 million.
22nd July – Threat Intelligence Report · 2024-07-22
Indian crypto company WazirX has confirmed a data breach that resulted in the loss of $230M, nearly half of its reserves. The breach compromised a multisig wallet and led to the theft of over 200 different cryptocurrencies, including significant amounts of SHIB, Ethereum, Matic, Pepe, USDT, and Gala tokens. The attackers are reportedly affiliated with North Korea.
WazirX multisig wallet breach · Jul 18, 2024
On-chain analysis and other information reviewed by Elliptic indicates that this hack was perpetrated by hackers affiliated with North Korea.
WazirX attack (July 18th, 2024; Safe Multisig wallet on Ethereum compromised) · published 2025-01-01
On July 18th, 2024, WazirX, India's leading domestic crypto exchange, suffered an attack that resulted in a $325 million loss. WazirX's Safe Multisig wallet on Ethereum was compromised. The attack has since been linked to North Korean hackers.
WazirX hack (Liminal multi-signature wallet) · July 2024
(MSMT/2025/2, report p. 30) “In July 2024, TraderTraitor actors conducted another heist stealing $230 million in cryptocurrency from India-based cryptocurrency exchange, WazirX. DPRK actors manipulated a digital signature on a smart contract that moved funds from WazirX’s cold storage wallet to the exchange’s hot wallet. ... WazirX has yet to resume normal activities following the loss of 45 percent of its users’ assets from the hack.” (Table 2 lists WazirX, 2024-07-18, 235 $ Million.)