Binance has distanced itself from the ongoing struggles of the Indian crypto exchange WazirX in a Sept. 17 statement.

According to Binance, WazirX co-founder Nischal Shetty made several misleading statements that suggested the exchange might be responsible for the losses suffered by Indian crypto trading platform users after a $235 million hack in July.

Binance called the accusations “outrageously misleading,” clarifying that it has never “owned, controlled, or operated WazirX at any time, including before, during, or after the alleged hack.”

Binance also stated:

“Their attempts to shift responsibility is a disappointing deflection tactic, but it should not distract anyone from the glaring issue to be addressed here: the need for the WazirX team to be held accountable for user funds lost under their management.”

Clearing the air

In the extensive post, Binance reiterated that it does not own WazirX despite earlier negotiations to acquire the Indian exchange.

According to the exchange:

“Binance never acquired or controlled WazirX. While a contract had been signed between the parties, the proposed transaction never closed due to Zettai’s failure to perform its obligations.”

Instead, WazirX is currently owned by Zanmai Labs Pvt Ltd, an India-based firm registered with local regulators. Zanmai is a subsidiary of Zettai, a Singapore-based company owned by Shetty.

Due to this, Binance rejected Shetty’s suggestion that Zettai’s creditors could seek compensation from the Richard Teng-led platform.

Binance stated:

“There is no legal basis, in any scenario, to the claim that Binance would be liable for claims against Zettai. Any suggestion of Mr. Shetty to this effect is incorrect.”

Furthermore, Binance acknowledged that it previously provided tech solutions and support for the embattled Indian exchange.

However, Binance denied any responsibility for the hack, clarifying that Shetty and Zettai chose Liminal as a custody provider without its involvement after WazirX’s funds were removed from its platform.

In addition, Binance also stated it was never part of WazirX’s user agreement. Despite demanding that any references to its name be removed from the agreement, Binance claimed Shetty and Zanmai have repeatedly ignored these requests.

Unresponsive WazirX

Despite distancing itself from the Indian exchange, Binance revealed that its attempt to help the WazirX team has been rebuffed.

According to the exchange, it has been unable to verify the hack independently because its request for reports about the attack has not been answered. It stated:

“We have requested the WazirX team to provide us with their reports on the incident including all internal reports as well as the purported report from Mandiant from Aug. 14, 2024, which details the cause of the attack, and verification of the amount and proportion of user funds affected, but these requests remained unanswered.”

Mentioned in this article

The hacker responsible for stealing over $235 million from the Indian crypto exchange WazirX has transferred around $10 million through sanctioned Tornado Cash in the past 24 hours, according to blockchain security firm Cyvers.

In a Sept. 5 message to CryptoSlate, Cyvers reported that the hacker had begun moving assets the previous day. So far, $10 million in Ethereum (ETH) has been laundered through Tornado Cash, including deposits of about $2 million in ETH.

Cyvers also noted that the hacker moved approximately 5,000 ETH (valued at $12 million) to a new wallet address, “0x2…968.”

Market analysts observed that the WazirX hacker’s laundering tactics resemble those employed by the North Korea-backed Lazarus Group. This group is reportedly behind more than $2 billion in crypto thefts and allegedly funds North Korean government activities.

Lazarus Group often uses Tornado Cash to obscure its transactions as part of a sophisticated laundering process, which sometimes involves chain-hopping.

 WazirX update

These laundering activities come as WazirX announced an early withdrawal window for users to access 66% of their Indian rupee (INR) token balances. Initially set for Sept. 9, the exchange moved the withdrawal date forward, allowing users to access funds sooner.

On Sept. 3, Nischal Shetty, the co-founder of the Indian crypto trading platform, stated:

“Phase 2 of INR withdrawals is live ahead of schedule. We’re working tirelessly to deliver even faster results. Our objective is to be ahead of schedule for all the timelines we share. We will try our level best to make it happen.”

However, some users expressed dissatisfaction with partial access and questioned when crypto withdrawals would resume. WazirX’s legal team has reportedly indicated that users might recover only 55% to 57% of their crypto holdings.

Meanwhile, the exchange has since filed for restructuring in Singapore to address its liabilities.

Mentioned in this article

Editor Editor

Liam ‘Akiba’ Wright

Senior Editor at CryptoSlate

Also known as “Akiba,” Liam is a reporter, editor and podcast producer at CryptoSlate. He believes that decentralized technology has the potential to make widespread positive change.

Embattled crypto platform WazirX has entered an initial 30-day moratorium following a $234 million hack in July, pending a decision by Singapore’s High Court on whether to grant an extension, according to an Aug. 28 statement.

This development arose as rival platform CoinSwitch announced its intention to pursue legal action to recover approximately $9.6 million in digital assets trapped on WazirX’s exchange.

Moratorium

WazirX revealed that Zettai Pte, the Singapore-incorporated company behind its operations, filed for the moratorium on Aug. 27. This filing triggered an automatic 30-day freeze, giving the firm time to draft a restructuring plan.

However, WazirX estimates it will need at least six months to finalize the plan and collaborate with stakeholders.

The company emphasized that the moratorium provides crucial breathing room to address users’ crypto balances and work toward recovering funds.

WazirX explained that under the planned restructuring, the hack’s impact would be distributed among users, who would receive a share of the available token assets proportional to their account balances.

WazirX co-founder and CEO Nischal Shetty noted that the restructuring timeline depends on how quickly the firm and its creditors can agree on a path forward. He added:

“One key factor in our timeline for restructuring is how quickly we can all come together and agree on a path forward. We need to be united in this effort. Your support and collaboration are crucial to making this happen.”

Legal threat

In an Aug. 28 thread on social media platform X, CoinSwitch stated that it had substantial assets — including fiat currency, ERC20 tokens, and other digital assets — stuck on WazirX’s platform following the recent hack.

CoinSwitch explained that it had been unable to recover the funds despite multiple attempts to resolve the issue. The company also expressed frustration over WazirX’s lack of clarity regarding a full recovery plan.

Due to this, the company stated that it has “no choice but to pursue legal action to recover the funds.”

Meanwhile, CoinSwitch assured its users that the affected funds represent less than 1% of its total assets. It is using its treasury reserves to maintain a 1:1 ratio for user holdings.

However, Shetty remains unfazed by the potential lawsuit and said that all users will be treated fairly, regardless of the size of their claims. He added:

“If legal actions are necessary, so be it.”

Mentioned in this article

Indian crypto exchange WazirX, recently targeted in a $235 million hack, has ended its asset custody arrangement with Liminal.

In an Aug. 14 statement, WazirX announced it was moving assets from Liminal to new multi-signature (multi-sig) wallets. This decision aims to enhance the security of its remaining assets after the breach.

It stated:

“This step is essential to ensure maximum security of the assets in light of recent events. While we believe our interface and systems remain uncompromised, the same cannot be said for the custodian’s interface post the July 18th incident, prompting this precaution.”

WazirX said it couldn’t provide a timeline for these asset transfers. However, it would carefully manage the transfer process to avoid a repeat of the hacking incident. It added that it would soon release the new wallets containing the digital assets.

WazirX stated:

“We are exercising extreme caution in how and when we move these assets, considering the complexity involved…For transparency, we’ll publish the list of all new wallets once the migration is complete.”

After last month’s hack, WazirX and Liminal exchanged blame over whose infrastructure the malicious players hacked.

WazirX’s post-incident report emphasized that its interface and systems were not compromised while pointing fingers at Liminal. Conversely, the custodial service provider contended that its infrastructure was not at fault and suggested the breach emanated from the crypto exchange.

Other updates

On Aug. 13, WazirX revealed that it was nearing the end of restoring balances for trades conducted between July 18 and July 21. This action will reverse all transactions on the platform that occurred after the withdrawal halt on July 18, 2024.

The company furthered that it was collaborating with legal experts to devise an effective strategy for resuming withdrawals on its platform.

It has also received reports from 344 bounty hunters, including security professionals and ethical hackers, actively tracking the stolen funds.

Additionally, the firm is in discussions with seven partners to address the financial fall-outs of the attack.

Mentioned in this article

India-based centralized exchange WazirX seeking partnerships to restore full operations following a significant exploit that resulted in the loss of nearly half its assets.

The exchange’s co-founder, Nischal Shetty, shared the development in a social media post on July 23 and notified users that it is working on a solution to help restart its services. He stated:

“I’ve been reaching out to various potential partners trying to figure a resolution that would help our customers. We’re figuring various directions that can possibly help enable the platform deposits/withdrawals/trading.”

The exploit

WazirX confirmed a security breach in one of its multisig wallets, resulting in the loss of over $230 million in user assets.

On-chain data revealed the theft included more than 200 cryptocurrencies, such as 5.43 billion SHIB tokens, over 15,200 Ethereum tokens, 20.5 million Matic tokens, 640 billion Pepe tokens, 5.79 million USDT, and 135 million Gala tokens.

The stolen funds represent roughly 50% of WazirX’s total $500 million holdings, according to its June proof-of-reserves report. The exchange has temporarily paused trading due to the hack’s impact on its ability to maintain 1:1 collaterals with assets.

Meanwhile, Shetty mentioned ongoing efforts to make customers whole, saying:

“We have few ideas, but we need to hash them out further to look into how feasible they are. I’ve been receiving many calls for help with this issue. We’re actively working with law enforcement to find the culprits and recover the funds.”

He also clarified that the hack did not affect the firm’s fiat INR funds but did not specify whether INR withdrawals would be enabled.

WazirX has launched a $23 million bounty program to incentivize the hackers to return the stolen funds. The firm has received 133 entries so far and is reviewing them.

However, market observers said the possibility of the funds being returned appears slim as the attackers have affiliation with North Korea’s notorious Lazarus Group.

Blame Game

WazirX has continued to maintain that the hack occurred outside its product infrastructure. It stated that the hacked multisig wallet was hosted by third-party custody provider Liminal.

However, Liminal argued that its infrastructure was not compromised and attributed the exploit to compromised devices owned by WazirX.

In response, WazirX has dismissed suggestions about compromised wallet hardware. Shetty explained:

“The WazirX hack was not due to a Phishing link. 3 signatures of WazirX from 3 different devices that each use different hardware wallets were used. All 3 devices were at different locations and the links were bookmarked.

He added:

“Even if we assume that all 3 WazirX devices ended up going to a phished link (which is highly unlikely given their geographic separation and saved links), it would still fail on Liminal’s end since they’re the 4th signer and the signing occurs inside their systems and not on a browser.”

Mentioned in this article

On-chain data shows that the WazirX exploiter has converted most of the stolen assets from the Indian crypto platform into Ethereum.

On July 18, WazirX was exploited for around $235 million in several digital assets, with blockchain investigators suggesting that the North Korea-backed Lazarus Group perpetrated the attack.

While the exchange quickly implemented measures to stop the theft, recovering the funds seems unlikely as the attacker actively converts the stolen assets into ETH, the second-largest digital asset by market capitalization.

WazirX exploiter holds nearly 60,000 ETH.

Blockchain analyst Lookonchain reported that the WazirX exploiter had converted most of the stolen assets to 43,800 ETH, worth $149.46 million. This brings the total ETH in the attacker holding to 59,097 ETH, valued at around $201.67 million.

Market observers suggested that the asset conversion was part of a sophisticated money laundering technique that also involves using crypto mixing services like Tornado Cash to obfuscate the transaction trails.

Despite this, the exploiter’s address still has up to $15 million worth of other relatively lesser-known digital assets left. This includes 1.66 billion DENT, worth $1.56 million, and 6.76 million CHR, worth $1.72 million, among others.

Meanwhile, on-chain data shows the exploiter sent 7.7 million DENT, worth $7,300, to a new Binance deposit address. Lookonchain said:

“It is worth noting that the WazirX exploiter deposited 7.7 million DENT ($7.3K) to a Binance deposit address that has not been used before.”

‘Force Majeure’

A post-mortem report from the exchange showed that the affected wallet used Liminal’s services, a digital asset custody and wallet infrastructure provider.

WazirX explained that the exploit resulted from discrepancies between the data on Liminal’s interface and the transaction’s content. It wrote:

“During the cyber attack, there was a mismatch between the information displayed on Liminal’s interface and what was actually signed. We suspect the payload was replaced to transfer wallet control to an attacker.”

The exchange also described the attack as a “force majeure” event beyond its control and assured it was actively working to recover the stolen funds.

Mentioned in this article

Blockchain security firm Cyvers Alert reported that the Indian exchange WazirX was exploited for around $235 million.

Cyvers stated:

“Our system has detected multiple suspicious transactions involving [WazirX’s] Safe Multisig wallet on the ETH network. A total of $234.9M of your funds have been moved to a new address. Each transaction’s caller is funded by Tornado Cash.”

Blockchain analyst Lookonchain reported that the stolen assets included 5.43 trillion SHIB tokens (worth $102 million), 15,298 ETH (valued at $52.5 million), 20.5 million MATIC (worth $11.24 million), 640.27 billion $PEPE (worth $7.6 million), 5.79 million USDT, and 135 million GALA (worth $3.5 million).

It added that the attacker was selling and converting those assets to ETH.

In a July 18 post on X, the crypto trading platform confirmed that one of its multisig wallets experienced a security breach that resulted in losing an undisclosed sum.

The firm added:

“Our team is actively investigating the incident. To ensure the safety of your assets, INR and crypto withdrawals will be temporarily paused.”

WazirX is one of the largest crypto trading platforms in India. Last year, the firm was involved in a public spat over its ownership structure, with WazirX’s founder, Nischal Shetty, insisting that Binance had acquired the exchange. However, Binance’s former CEO, Changpeng Zhao, vehemently denied these claims.

North Korea link

Meanwhile, Cyvers suggested that North Korea-backed hacker Group Lazarus might be involved in the attack.

Deddy Lavid, the Co-founder & CEO of Cyvers Alert, told CryptoSlate:

“The use of TornadoCash to fund the transactions is indicative of methods used in previous high-profile attacks. While it is too early to definitively link this incident to the Lazarus Group, the similarities are concerning.”

Over the past few years, Lazarus Group has emerged as one of the most notorious hacking groups targeting the crypto industry. A Chainalysis report estimated that the North Korean hackers have stolen over $3 billion in the past five years.

Mentioned in this article