🌎 WazirX Reports Multisig Wallet Hack, Suspects Lazarus Group

Mumbai-based WazirX crypto exchange has released its post-mortem report on a “force majeure” incident that led to a multi-sig wallet hack.

Earlier reports indicated that WazirX was hacked for $230 million in cryptocurrencies after bad actors compromised the platform’s wallet management UI. The Indian crypto exchange explained that the issue originated from discrepancies in data displayed on Liminal’s interface, the digital asset custody, and the wallet infrastructure employed by WazirX.

The platform’s multi-sig wallet required three signatures from internal WazirX team members and one final approval from Liminal. During the cyber attack, there was a mismatch between the information displayed on Liminal’s interface and what was actually signed. The team suspects the payload was replaced to transfer wallet control to an attacker.

The crypto exchange stated it would leave no stone unturned regarding recovering stolen funds and locating the perpetrator.

At WazirX, our commitment to transparency and community welfare is paramount. There was a cyber attack on one of our multisig wallets. Below are the preliminary findings to clarify the situation:

While WazirX seems determined to pursue the hackers, the prime suspect indicates recovery might be impossible. Notably, the hack bears the hallmarks of the notorious North Korean criminal organization Lazarus.

Lazarus is credited with some of the largest crypto exploits, including Axie Infinity’s $600 million Ronin Bridge hack and the $308 million DMM Bitcoin theft. The syndicate is also the subject of U.S. sanctions over money laundering and terror financing. Funds are rarely recovered when Lazarus is involved.

Blockchain data provider Arkham noted that the hacker had already offloaded nearly half of the loot. Freezing funds worth $102 million may still be possible depending on the sell destination, whether a centralized exchange or otherwise.