Massive $230 Million Crypto Heist: WazirX Exchange Hit by Major Security Breach

Indian cryptocurrency exchange WazirX has fallen victim to a massive security breach, resulting in the theft of $230 million in cryptocurrency assets. The exchange confirmed the attack, revealing that it was targeted through one of its multi-signature wallets, which was managed using Liminal’s digital asset custody and wallet infrastructure since February 2023.
Anatomy of the Breach

WazirX detailed that the breach originated from a discrepancy between the data displayed on Liminal’s interface and the actual signed information. This inconsistency allowed the attacker to replace the payload and seize control of the wallet. Multi-signature wallets, which require multiple approvals to execute transactions, are generally considered secure. However, in this instance, the attacker’s sophisticated tactics managed to circumvent these protections.

“Liminal is one of the six signatories on the compromised wallet, responsible for transaction verifications,” WazirX stated. The exchange emphasized that preliminary investigations indicate the breach occurred outside of Liminal’s ecosystem.

“Liminal’s self-custody multi-sig smart contract wallet, created independently of our platform, was compromised,” Liminal confirmed on social media. They assured users that all wallets created on the Liminal platform remain secure, and malicious transactions were executed outside of their platform.

Suspected North Korean Involvement

Blockchain analytics firm Elliptic has suggested that the attack bears the hallmarks of North Korean threat actors. These cybercriminals have a notorious history of targeting the cryptocurrency sector to circumvent international sanctions. The attackers swiftly converted the stolen assets to Ether using various decentralized services.

Crypto researcher ZachXBT supported this theory, indicating the WazirX hack shows potential signs of a Lazarus Group operation, a well-known North Korean cybercrime syndicate.

A History of Crypto Attacks

North Korea-affiliated hackers have been implicated in numerous cyber attacks on the cryptocurrency industry since at least 2017. These attacks are part of the regime’s strategy to evade economic sanctions and fund its nuclear weapons program. The United Nations reported earlier this year that between 2017 and 2023, nation-state actors, primarily from North Korea, carried out 58 suspected intrusions, amassing $3 billion in illegal revenues.

The WazirX breach is the latest in a series of high-profile cryptocurrency thefts attributed to North Korean hackers. These attacks have escalated in both frequency and sophistication, highlighting the urgent need for enhanced security measures within the crypto industry.

Operation Spincaster and Crypto Scams

The WazirX breach comes on the heels of Operation Spincaster, a coordinated law enforcement initiative that dismantled several scam networks. These networks were exploiting approval phishing tactics, a method where scammers trick users into signing malicious blockchain transactions. This gives the scammer’s address approval to spend specific tokens from the victim’s wallet, allowing them to drain the wallet at will.

Since May 2021, this technique has resulted in an estimated $2.7 billion in stolen funds through fake crypto apps and romance scams, also known as pig butchering. Chainalysis, a leading blockchain analysis firm, has been instrumental in tracking these fraudulent activities and providing insights into the methods used by cybercriminals.