Largest Indian cryptocurrency exchange hacked, $230 million stolen

A hacker linked to North Korea who extracted $230 million from the Indian cryptocurrency exchange WazirX converted most of the loot into ethereum, reported blockchain tracking tool Lookonchain.

The exploiter holds more than 59,097 ethereums as of Friday morning, valued at $200 million at current prices, and another $15 million in various tokens. Hackers generally convert tokens into ethereum to use mixing services, such as Tornado Cash, which masks transactional activities and facilitates money laundering.

As of Friday morning, almost all tokens listed on WazirX were trading at significant discounts compared to their global and local prices, indicating weak liquidity and enormous selling pressure.

The bitcoin/rupee trading pair fell 22 percent in the last 24 hours, compared to other local exchanges such as CoinDCX and Zebpay where prices fell two percent. The shiba inu/rupee pair dropped by 30 percent.

WazirX’s own WRX token fell 40 percent in the last 24 hours. Meanwhile, trading volume on the exchange surged to $8 million in the last 24 hours compared to $2.2 million on Wednesday.

WazirX was hit by a security breach on Thursday in one of its multi-sig wallets, causing over $100 million in shiba inu and $52 million in ethereum, among other assets, to be withdrawn. The stolen funds accounted for more than 45 percent of the total reserves the exchange reported in June 2024, diminishing hopes of recovering funds for users.

The exploitation was blamed on a mismatch between the digital interface and the exchange’s main crypto wallet, despite the fact that the multi-sig wallet storing user funds has five signatories. Generally, multi-sig wallets are a type of crypto wallet with additional security settings typically used to require two or more people to authorize outgoing transactions.

– During the cyber attack, there was a mismatch between the information displayed on Liminal’s interface and what was actually signed. We suspect that the user payload was swapped to transfer wallet control to the attacker – wrote WazirX.

However, some in the Indian crypto community expressed distrust in that explanation.

Crypto and fiat withdrawals from WazirX have been temporarily paused.