WazirX, July 2024: how a 4-of-6 multisig lost $235 million to a mis-signed transaction

What happened

On 18 July 2024, WazirX, then one of India's largest cryptocurrency exchanges, said one of its multi-signature wallets had "experienced a security breach" and paused INR and crypto withdrawals ^[6]. The wallet was an Ethereum Gnosis Safe multisig operated through Liminal Custody's wallet infrastructure since February 2023 ^[1]. WazirX put the loss at more than $230 million ^[1]. Elliptic put it at around $235 million across more than 200 assets, including roughly $96.7 million of Shiba Inu, $52.6 million of Ether, $11 million of Matic and $7.6 million of Pepe ^[6]. Cyvers flagged about $234.9 million moved from the Safe to another address ^[30]. Approximately 45% of the crypto assets on the platform were affected; INR balances were not ^[2]. The exchange had reported holdings of about $500 million in its June 2024 proof-of-reserves disclosure ^[8].

The wallet had six signatories: five from WazirX and one from Liminal ^[1]. A transaction required approval from three WazirX signatories, all using Ledger hardware wallets, followed by a final approval from Liminal's signer ^[1]. Liminal described the contract as a 4-of-6 multisig, with the five WazirX keys never exposed to Liminal and a single Liminal HSM key that signs at the behest of authorisations from WazirX's side ^[4]. A destination-address whitelist was in place, facilitated on Liminal's interface ^[1].

WazirX's first-day statement said the attack "stemmed from a discrepancy between the data displayed on Liminal's interface and the transaction's actual contents", and that it suspected the payload had been replaced to transfer wallet control to an attacker ^[1]. Liminal's position, published the next day, was that its infrastructure was not breached and that "three of the victims machines have been found injecting malicious payloads into the transaction" ^[4]. The two firms have blamed each other since 19 July 2024, and each later commissioned a forensic review that supported its own position ^[13][15][16]. That disagreement is unresolved in public and is the central fact of this case.

WazirX halted all trading on 21 July 2024 ^[3] and on 27 July proposed a "socialised loss" model returning only 55% of every user's holdings ^[9]. Its Singapore parent, Zettai Pte Ltd, entered a court-supervised restructuring not sanctioned until 13 October 2025 ^[22]. The platform restarted on 24 October 2025 and paid roughly 85% of approved claims within ten business days ^[26]. Elliptic attributed the theft to hackers affiliated with North Korea on the day ^[6]; in January 2025 the United States and the Republic of Korea attributed it to the DPRK ^[7].

How they got in

There is no agreed account of initial access, so both positions are set out here without adjudication.

WazirX's account. In its findings of 25 July 2024, WazirX said it had found no evidence that its signers' machines were compromised ^[2]. The three devices that signed the malicious transactions were in three locations on three internet connections; all three signers used hardware wallets; two used dedicated signing devices and one used a work device ^[2]. WazirX argued that because the malicious transactions carried three WazirX signatures and one Liminal signature they must have flowed through Liminal's infrastructure, and that the destination was not on the whitelist Liminal's firewall should have enforced ^[2]. It also noted that hardware wallets often do not display the token or destination when signing ERC-20 transactions ^[2]. On 19 August 2024 WazirX published a finding from Mandiant, which it had engaged for forensic analysis: "We did not identify evidence of compromise on the three laptops that were used for signing transactions" ^[15]. WazirX said the findings "largely indicate that the issue leading to the cyberattack originated from Liminal" ^[15].

Liminal's account. Liminal's report of 19 July 2024 describes a sequence it says began at 10:08 on 18 July 2024 ^[4]. One WazirX signer attempted a GALA transaction; Liminal's platform had supplied the correct safeTxHash in the pre-build but received a different safeTxHash and signature back from the user's device, so it rejected the transaction and displayed an error ^[4]. A second signer's GALA transaction was rejected the same way; a third signer then approved a USDT transaction that already had two valid signatures, and his device returned a signature over the malicious payload ^[4]. With three WazirX signatures received, the Liminal signer added the final signature and broadcast the transaction, which failed on-chain because one signature was invalid; in Liminal's analysis the attacker nonetheless now held three reusable signatures ^[4]. Liminal concluded the three machines were compromised and the payload altered "using a sophisticated MIM attack or similar client side compromise" ^[4]. It said its signer only signs once the required number of valid client signatures has arrived, a configuration set at WazirX's request ^[12]. In September 2024 Liminal reported that a Grant Thornton review found no evidence of compromise in its front end, back end or UI relating to the transaction workflow, while acknowledging a discrepancy between the payloads its system created and those received from the client ^[16]. Liminal stressed that the wallet was a self-custody Safe deployed by WazirX before onboarding and imported at WazirX's request, and that Liminal can never initiate a transaction ^[4][5].

What both sides agree on. The wallet was drained by a transaction carrying three WazirX signatures and one Liminal signature ^[2][4]. There was a mismatch between what Liminal's system generated and what came back signed ^[2][16]. The executed transaction was not a whitelisted transfer ^[2][4]. Neither firm has published evidence of how the first signer's session was manipulated, and the Delhi Police inspection reported no evidence of unauthorised access to WazirX's systems ^[19]. Secureline treats initial access as unresolved.

How it escalated

The escalation step is better documented. According to WazirX, the approved transaction "seemed to have upgraded the contract to transfer the control to the attacker" ^[2]. The attacker had created smart contracts on 10 July 2024, eight days earlier, with no interaction with the WazirX wallet until 18 July ^[2]. WazirX added that Liminal had represented that a contract upgrade cannot be initiated from its interface ^[2]. Liminal said that once the malicious contract was deployed, all subsequent withdrawals were made from outside its infrastructure ^[4].

This is why one mis-signed transaction cost the whole wallet. The threshold and whitelist are enforced by the wallet's logic and the co-signing service; once the signers had authorised a change to that logic, neither the 4-of-6 threshold nor Liminal's whitelist constrained what followed ^[2][4]. Lookonchain reported more than 200 cryptocurrencies taken, including over 15,200 ETH, 20.5 million MATIC, 5.79 million USDT and 135 million GALA ^[8]. Elliptic valued the outflow at about $235 million ^[6]. Cointelegraph noted the attack succeeded despite the Gnosis Safe platform and a whitelisting policy ^[11].

The Indian police investigation adds one strand. The Delhi Police chargesheet records that the attackers drained WazirX's hot wallet and then moved on the cold wallet, and that a WazirX account opened under the false name Souvik Mondal was sold via Telegram to a person identified as M Hasan, who allegedly used it in the breach ^[19]. Published reporting does not explain how that account related to the signing-flow manipulation, and nothing public connects it to the North Korea attribution ^[19].

What the attackers did next

Within hours the attacker began swapping stolen tokens for Ether through decentralised services, which Elliptic described as the expected first step of a typical laundering process ^[6]. Lookonchain observed SHIB being sold into ETH on the day ^[30]. WazirX said it contacted more than 500 exchanges to block the identified addresses and offered a bounty of 10% of recovered funds, up to $23 million ^[3]. It also said it had "tracked and blocked some funds from wallet services" but gave no figure ^[3].

Laundering through Tornado Cash accelerated in September 2024 ^[17]. By 25 September 2024, Arkham data cited by CoinDesk showed just over $50 million moved to Tornado Cash in August, more in September, and only about $6 million of ETH left in the main wallet ^[17]. No material recovery of the stolen assets is reported in any source reviewed; the restructuring scheme relies on platform profits and "illiquid assets" for further distributions ^[26].

Attribution. Elliptic said on 18 July 2024 that "on-chain analysis and other information" indicated the hack was perpetrated by hackers affiliated with North Korea ^[6], citing "patterns and techniques that are characteristic of this type of actor" ^[30]. ZachXBT said the hack had "the potential markings of a Lazarus Group attack" ^[30]. On 14 January 2025 a joint statement by the United States, Japan and the Republic of Korea described the Lazarus Group as a DPRK-affiliated advanced persistent threat and said the United States and the Republic of Korea "additionally attribute to the DPRK, based on detailed industry analysis, thefts last year against WazirX for $235 million" ^[7]. The theft is therefore attributed by Elliptic to North Korea-affiliated actors, by ZachXBT to the Lazarus Group, and by the US and Korean governments to the DPRK ^[6][7][30].

Detection and response

Public detection came from the chain. Cyvers and Elliptic flagged the outflows on 18 July 2024, and WazirX paused withdrawals after reports of a hack began circulating online ^[30][6]. WazirX published a preliminary report the same day naming the affected wallet address ^[1]. Liminal said it was notified on 18 July 2024 ^[5].

WazirX's steps, per its update of 21 July 2024: an online complaint on the National Cyber Crime Reporting Portal, reports to FIU-IND and CERT-In, outreach to more than 500 exchanges, engagement of cybersecurity experts, a bounty, suspension of deposits and withdrawals and, from 21 July, of all trading ^[3]. CoinDesk reported that the exchange filed a police report and engaged CERT-In on 19 July 2024 ^[13]. An FIR was later filed with the Delhi Police Special Cell ^[15], and the IFSO unit seized the three signing laptops ^[19]. No source reviewed gives the time of the CERT-In report relative to the six-hour window in CERT-In's 2022 directions ^[3][28].

What did not work was communication. The socialised-loss plan of 27 July 2024 would return 55% of holdings and lock 45% as USDT-equivalent tokens, valued at prices on 21 July 2024 at 8:30 PM IST, and it applied even to users whose tokens were in the "not stolen" category ^[10]. It was presented as an opinion poll with an Option A (trade and hold, priority in recovery, no withdrawals) and an Option B (trade and withdraw, lower priority) ^[10][9]. On a community call the founder, Nischal Shetty, confirmed that customer funds were not insured ^[9]. Policy commentator Nikhil Pahwa observed that WazirX was "reaching into user wallets and taking out crypto and giving it to others" ^[9]. The vendor dispute added uncertainty: on 14 August 2024 WazirX said it was migrating remaining assets to new multisig wallets because "the same cannot be said for the custodian's interface", while a Liminal spokesperson replied that the client "could have removed the funds immediately post the incident" ^[14].

What worked was seeking a binding, court-supervised outcome. Zettai engaged Kroll and Rajah & Tann Singapore in July 2024 to apply to the Singapore High Court for a moratorium ^[23]. The court granted a four-month moratorium on 26 September 2024, shorter than the six months requested, on conditions including disclosure of wallet addresses by affidavit, disclosure of the books within six weeks, responses to user queries, and any future vote on an independent platform ^[18].

Impact

Money. The stolen assets were worth about $230 million to $235 million at the time ^[1][6]. Total creditor claims as of 18 July 2024 at 1:00 PM IST were $546 million ^[26]. Under the sanctioned scheme, creditors received a first distribution of roughly 85% of approved claims, valued at a reference token pricing date, within ten business days of the restart on 24 October 2025 ^[26]. The remainder is represented by Recovery Tokens, allocated pro rata by 9 January 2026, which are not tradable and may be bought back when at least $10 million in unencumbered value is realised in a three-month evaluation cycle, with shortfalls rolling forward ^[26][27].

Users. Business Standard reported 4.3 million creditors in total ^[25]. In the first vote, run on the Kroll Issuer Services platform from 19 to 28 March 2025, 141,476 creditors representing $195.65 million in approved claims voted, of whom 131,659 representing $184.99 million voted in favour, 93.1% by count and 94.6% by value, against a statutory threshold of a majority by count and 75% by value under section 210(3AB) of the Singapore Companies Act ^[20]. In the revote of 30 July to 6 August 2025, around 149,000 creditors representing $206.9 million participated and about 143,000 representing $195.7 million voted in favour, 95.7% by count and 94.6% by value ^[24][25].

Legal and regulatory. On 4 June 2025 the Singapore High Court declined to sanction the first scheme after Zettai disclosed that it had incorporated a Panama subsidiary, Zensui Corporation, on 10 March 2025 and agreed to transfer platform operations to it, facts not previously communicated to users or the court; Zettai also said it did not intend to obtain a Singapore digital token service provider licence or to register Zettai with FIU-IND ^[21]. The revised scheme was sanctioned with modification on 13 October 2025 ^[22][24] and took effect on 15 October 2025 when the order was lodged with ACRA ^[23]. In India, the Delhi Police arrested SK Masud Alam, a West Bengal resident, in connection with the fake account, and their chargesheet recorded alleged non-cooperation by Liminal, which Liminal said had replied to the authorities and met IFSO officials ^[19].

Vendor and market. WazirX ended its custody relationship with Liminal on 14 August 2024 ^[14] and moved to BitGo for the relaunch ^[22]. Competitors CoinDCX and CoinSwitch issued public reassurances to their own customers on the day of the breach ^[8]. SHIB, the largest stolen asset, fell about 10% on the day ^[30].

Root cause

The control that failed was transaction integrity at the point of signing. Three people with hardware wallets signed a payload that was not what they believed they were signing, and the fourth signer, an automated HSM key, added its signature because the required number of client signatures had arrived ^[1][4][12]. Whether the manipulation happened on the signers' machines, as Liminal maintains, or in the custody interface, as WazirX maintains, does not change the analysis: nothing in the chain independently verified that the calldata being signed matched a permitted operation ^[2][4]. Hardware wallets did not help because, as WazirX noted, they often do not display token or destination for ERC-20 transactions, and the operation was a change to the Safe's implementation rather than a transfer ^[2].

Second, the architecture allowed the same signing quorum that moved funds to change the wallet's logic. WazirX said the approved transaction upgraded the contract and transferred control to the attacker ^[2]. Liminal said withdrawals after that point happened outside its platform entirely ^[4]. A whitelist enforced by a co-signer is only as strong as the co-signer's ability to recognise what it is co-signing, and in this case the co-signer signed a transaction to a non-whitelisted destination ^[2][4].

Third, concentration and transferred risk. Roughly 45% of platform crypto sat in one wallet ^[2], created outside Liminal's platform and imported into it ^[4]. Liminal's product terms place key security and insurance on the client in its self-custody model ^[5], and the client had no insurance ^[9]. Fourth, the boundary between exchange and custodian was unclear enough that each produced a forensic review exonerating itself ^[15][16] and police reported difficulty obtaining logs from the custodian ^[19].

Lessons for Indian firms

CERT-In reporting. CERT-In's directions of 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, require service providers, intermediaries, data centres, body corporates and government organisations to report the cyber incidents listed in Annexure I within six hours of noticing them or being brought to notice of them ^[28]. Annexure I explicitly covers malicious or suspicious activity affecting systems related to "virtual assets, virtual asset exchanges, custodian wallets" ^[28]. The directions also require ICT logs to be kept for a rolling 180 days within Indian jurisdiction, and require virtual asset service providers, exchange providers and custodian wallet providers to keep KYC and transaction records for five years in a form that allows each transaction to be reconstructed, including IP addresses, timestamps, public keys and addresses ^[28]. Non-compliance may attract punitive action under section 70B(7) ^[28]. WazirX reported the incident to CERT-In and FIU-IND, though the timing is not public ^[3]. Because the six-hour clock starts at "noticing", a VDA firm needs an on-call incident lead with pre-approved authority to file a minimal first report, and its 180-day log retention must cover the signing workstations and the custody vendor's API, not only the trading platform ^[28].

FIU-IND registration. Under the Ministry of Finance notification of 7 March 2023, exchange between virtual digital assets and fiat, exchange between VDAs, transfer of VDAs, and "safekeeping or administration of virtual digital assets or instruments enabling control over virtual digital assets" are activities under the Prevention of Money-laundering Act, and providers must register with FIU-IND as reporting entities; failure to register is itself non-compliance attracting action under section 13(2) ^[29]. Registration requires an in-person meeting of the designated director and principal officer at FIU-IND and disclosure of corporate structure, beneficial ownership and any arrangements with entities in India or abroad ^[29]. The Singapore court's refusal of 4 June 2025 turned partly on Zettai's statement that it did not intend to register with FIU-IND, even though its Indian subsidiary was registered ^[21]. An Indian regulator and a foreign court will both ask which legal entity actually holds customer assets, and the answer must be the same in both forums.

Custody-provider liability. Liminal's description of its self-custody product is explicit: the majority of keys stay with the client, Liminal can never initiate a transaction, and "our clients are the custodians of the user assets and are responsible for having proper security measures, a secure infrastructure setup and insurance in place" ^[5]. If that is the contractual position, the exchange is the custodian for regulatory purposes regardless of the vendor's branding ^[5]. Indian firms should read custody contracts for whose key enforces policy and what it checks; whether the vendor retains signing logs and will release them to Indian police, given that the Delhi Police chargesheet records difficulty obtaining them ^[19]; audit rights that survive a dispute; and insurance.

Communication with users. Worth copying: the preliminary report published within hours naming the affected wallet ^[1]; the day-wise updates ^[3]; and a creditor vote run on an independent platform and verified by an independent assessor, Alvarez & Marsal ^[20]. Worth avoiding: declaring "force majeure" and asserting that "all necessary steps" had been taken before any forensic review existed ^[1]; announcing, as an opinion poll, a socialised-loss model that cut users whose tokens were untouched to 55% ^[10][9]; and letting a vendor dispute play out in competing press statements while users could not withdraw ^[13][14]. The Singapore judge's refusal to sanction a scheme because creditors had not been told about the Panama entity before voting is the sharpest version of the same lesson: disclosure must precede the ask ^[21].