Indian cryptocurrency exchange WazirX said Thursday (July 18) that it lost more than $230 million in a cyberattack.
“This is a force majeure event beyond our control, but we are leaving no stone unturned to locate and recover the funds,” the company said in a preliminary report posted on its website. “We have already blocked a few deposits and reached out to concerned wallets for recovery. We are in touch with the best resources to help us in this endeavor.”
WazirX said in the report that the cyberattack targeted one of its multisig wallets that use the services of Liminal’s digital asset custody and wallet infrastructure.
The wallet has six signatories responsible for transaction verifications, and approval from three WazirX signatories and from one Liminal signatory was typically required for a transaction, according to the report.
The company also whitelisted destination addresses to enhance security, per the report.
“The cyberattack stemmed from a discrepancy between the data displayed on Liminal’s interface and the transaction’s actual contents,” WazirX said in the report. “During the cyberattack, there was a mismatch between the information displayed on Liminal’s interface and what was actually signed. We suspect the payload was replaced to transfer wallet control to an attacker.”
Liminal said in a Thursday post on X that its platform was not breached and that its infrastructure, wallets and assets remain safe.
“Our preliminary investigations show that one of the self-custody multisig smart contract wallets created outside of the Liminal ecosystem has been compromised,” the company said in the post.
It added in another post that WazirX wallets created on the Liminal platform remain secure and that all the malicious transactions occurred outside the Liminal platform.
“Adhering to our rigorous security protocols, the Liminal team is also readily assisting the WazirX team as they carry out their investigation,” Liminal said in a third post.
Blockchain data firm TRM Labs said on July 5 that the amount of cryptocurrency stolen by hackers more than doubled over the past year.
The total rose from $657 million in cryptocurrency in the first half of 2023 to $1.38 billion in the first half of 2024, according to the company.
