WazirX Finds No Evidence of Compromised Devices in $235M Hack Investigation

July 27, 2024

WazirX, a well-known cryptocurrency exchange, has shared new details about the July 18 hack that resulted in a $235 million loss. According to their July 25 report, they found no evidence that their devices were compromised. Instead, they suspect the breach may have happened through their multi-party computation (MPC) wallet provider, Liminal.

Key Points:

• No Evidence of Compromised WazirX Devices: The investigation did not find any proof that WazirX's machines were hacked.
• Potential Breach in Liminal's System: WazirX believes the hack might have occurred in Liminal's infrastructure.
• Malicious Transaction: The hack involved upgrading the multisig wallet contract, which gave control to the attacker.
• CBI Involvement: India's Central Bureau of Investigation (CBI) is a client of Liminal, raising concerns about the security of digital assets they hold.

Investigation Details:

WazirX's team looked into the hack to identify vulnerabilities. They didn't find any evidence of compromised machines on their end. They are now conducting a detailed forensic analysis to get to the bottom of the attack.

Possible Explanations for the Hack:

WazirX Finds No Evidence of Compromised Devices in $235M Hack Investigation WazirX suggests two possible scenarios:

1. Breach in Liminal's System: This could have caused their user interface to show false information.
2. Compromised WazirX Devices: This would have led to incorrect information being displayed. They favor the first explanation because:

• There were no new connection requests to WazirX's hardware wallets.
• The request came from a whitelisted address.
• All signers saw the correct token names and destination addresses.

Broader Implications for Crypto Security:

This incident highlights a big security issue: 'blind signing.' In this process, users can't see the destination address on their hardware wallet's screen, relying heavily on trust in custody providers.

Conflicting Reports:

Liminal's report from July 19 contradicts WazirX's findings. Liminal claims their system wasn't breached and suggests the attacker may have taken control of all three WazirX devices.

What's Next:

As the investigation continues, both companies are waiting for final forensic results. This incident is a reminder of the security challenges in the cryptocurrency world. WazirX has promised to share 'conclusive evidence' once their detailed analysis is done, showing their commitment to transparency and security. Stay tuned for more updates on this story.