WazirX: India Hack
What happened
On July 18, 2024, WazirX suffered a theft of more than $230 million in digital assets from a multisignature wallet using Liminal's wallet infrastructure. The companies disputed how the wallet was compromised. WazirX suspended deposits, withdrawals and trading in response.
WazirX's preliminary report described a mismatch between the displayed transaction and signed payload. Liminal denied a breach of its infrastructure and described the affected wallet as a customer self-custody wallet. The reviewed reports do not establish a mutually agreed initial compromise or prove how the attacker obtained control.
Case & protocol details
How it happened
- According to WazirX, the wallet normally required approval from three WazirX signatories followed by Liminal's signatory.
- WazirX reported that the transaction data displayed to its signers differed from what they signed, and suspected that a substituted payload transferred wallet control to the attacker.
- Assets worth more than $230 million were stolen from the affected wallet.
- WazirX suspended deposits, withdrawals and trading while investigating and pursuing the stolen funds.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report x.com
- report Preliminary Report: Cyber Attack on WazirX Multisig Wallet wazirx.com
- report Day-Wise Report: WazirX Cyber Attack Incident wazirx.com
- analysis Website reference x.com
- analysis Website reference x.com
- analysis Important Update: Cyber Attack Incident and Measures to Protect Your Assets wazirx.com
- analysis Liminal Remains Secure Amidst Sophisticated Attack liminalcustody.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
