On Thursday, July 18, 2024, Indian cryptocurrency exchange WazirX detected a severe security breach involving its Safe Multisig wallet on the Ethereum network. The breach resulted in unauthorized transfers of approximately $234.9 million worth of digital assets to a new address, according to a report from Cointelegraph.

• WazirX's Safe Multisig wallet on Ethereum has been compromised, resulting in the transfer of over $230 million worth of crypto assets, including SHIB, ETH, and MATIC. 

• In response, WazirX pauses all withdrawals to protect user funds.

• Both Cyvers and ZachXBT are actively investigating the breach.

Cyvers’ alert about WazirX hack | Source: X 

The security breach was first reported by Web3 security firm Cyvers. According to Cyvers, the funds were transferred from WazirX’s wallet to a new address, which had been funded by Tornado Cash, a decentralized protocol known for private transactions.

List of crypto assets stolen in WazirX hack | Source: LookOnChain on X

The moved funds included a mix of Shiba Inu (SHIB), Tether (USDT), Pepe (PEPE), and Gala (GALA), which were subsequently swapped into Ether (ETH).

On-chain investigator ZachXBT provided additional insights into the wallet's holdings. According to ZachXBT, the suspected primary attacker still holds significant amounts of various cryptocurrencies, including:

• $100 million in Shiba Inu (SHIB)

• $52 million in Ethereum (ETH)

• $11 million in Polygon (MATIC)

• $4.7 million in Floki Inu (FLOKI)

• $3.2 million in Fantom (FTM)

• $2.8 million in Chainlink (LINK)

• $2.3 million in Fetch.ai (FET)

Source: WazirX on X 

In response to the breach, WazirX has temporarily suspended all cryptocurrency and INR withdrawals on the platform to safeguard user assets. In an official X post, the exchange acknowledged the incident, stating:

"We are aware that one of our multisig wallets has experienced a security breach. Our team is actively investigating the incident. To ensure the safety of your assets, INR and crypto withdrawals will be temporarily paused."

The breach's association with Tornado Cash has raised concerns about the attack's potential links to high-profile hacking groups. Deddy Lavid, CEO of Cyvers, noted similarities between this breach and previous attacks attributed to the notorious Lazarus Group, a North Korean state-sponsored hacking collective.

Both Cyvers and ZachXBT are actively monitoring the situation. The compromised funds' swift movement and conversion into different digital assets suggest an attempt to launder the stolen assets.

This breach marks the second-largest crypto hack of 2024, following the DMM Bitcoin security breach in May. The incident highlights the growing need for robust security measures in the crypto industry, especially for exchanges handling large volumes of digital assets.

As WazirX actively investigates the breach, it's still early to determine whether the stolen funds can be fully recovered or if user funds have been affected.  The full impact of the breach remains uncertain and users are advised to stay informed through official updates from WazirX as the situation develops.