WazirX Hack: What a $235 Million Multisig Theft Teaches Every Exchange

How did the WazirX hack drain about $235 million when every transfer from the wallet needed four separate approvals? That question still comes up whenever Indian or Pakistani traders talk about exchange safety. The short answer: the approvers signed something different from what their screen showed. That is why the WazirX hack is now a lesson in checking what you sign.

This post is written as a lessons-learned report. It covers the confirmed facts first. Then it turns each failure into a habit you can use, whether you run a company wallet or just hold coins on an app.

• What happened on July 18, 2024, and what each source actually confirms
• How a four-signature wallet was still emptied, explained without exploit detail
• Why WazirX and its custody partner Liminal blamed each other
• How strong the North Korea attribution really is
• Seven lessons for exchanges, companies and everyday users in Pakistan

What Was the WazirX Hack?

WazirX was one of India's best-known crypto exchanges, run from Mumbai. On July 18, 2024, it paused all withdrawals after one of its multisig wallets was emptied. TechCrunch reported that the company put the loss at about $230 million, close to half of its reserves.

A multisig wallet is one that needs several keys to approve a payment. This one had six possible signers. Five worked for WazirX and one belonged to Liminal, the custody firm whose tools the exchange used. According to WazirX's preliminary report, as summarized by Business Today, any outgoing transaction needed three WazirX approvals plus the Liminal approval. Payments could also go only to pre-approved addresses.

On paper, that is a careful setup. In practice, it fell in a single afternoon. Blockchain analytics firm Elliptic counted roughly $235 million in stolen assets spread across more than 200 tokens. You will see both $230 million and $235 million in the news. The gap comes from token prices at the moment each party counted.

WazirX Hack Timeline: From One Signed Transaction to a Court-Approved Restart

The table below lists only dates that appear in the linked sources. Where a source gives a month but not a day, the table says so.

WazirX Hack Explained: How Four Approvals Still Failed

Here is the WazirX hack explained at the level a defender needs. No exploit steps are included, and none are needed to learn from it.

When a signer approves a multisig payment, two things happen. A web screen shows a summary, such as "send this amount to this address." Then the signer confirms on a device that holds their key. The key signs a block of data, often called the payload. The signer trusts that the summary and the payload match.

WazirX said that during the attack there was a mismatch between what Liminal's interface displayed and what was actually signed. The company suspected the payload had been swapped. The new version handed control of the wallet to the attacker, as TechCrunch reported. Once the attacker controlled the wallet itself, the address whitelist no longer mattered. A rule that blocks payments to unknown addresses does nothing if the thief can rewrite the rules.

The key point is simple. Every signer did their part, yet the extra signatures added little protection because all of them trusted the same screen. Four people approving the same false picture is still one point of failure.

Where Did the Mismatch Come From?

This is the part nobody has settled in public. WazirX said its investigators at Mandiant found its laptops and systems clean. In its view, the evidence pointed toward Liminal. Liminal hired Grant Thornton, whose review found "no evidence" that the attack came from Liminal's web application, as Inc42 reported. Liminal also said the wallet involved was created outside its own ecosystem.

Each review was paid for by one side and looked at that side's systems. Neither full report has been made public. So the root cause of the mismatch is still disputed. You should treat any article that names a single culprit with care.

How Much Did the WazirX Hack Cost, and Who Felt It?

Elliptic's breakdown shows that a few tokens made up most of the loss. Shiba Inu tokens made up about $96.7 million and ether about $52.6 million. Polygon's MATIC came to about $11 million and PEPE to about $7.6 million. The rest was scattered across more than 200 smaller holdings.

For customers, the hit was large. Inc42 reported that the theft drained about 45% of user funds. Withdrawals stayed frozen for over a year. In 2025, Business Standard reported that the platform had about 4.3 million creditors. In the rerun vote, around 149,000 of them took part, holding $206.9 million in claims.

The loss was spread across all users, not only those whose coins sat in the drained wallet. That is how the court-approved scheme handled it. On a custodial exchange, your balance is really a claim on a shared pool.

Who Was Behind It, and How Sure Is Anyone?

There are two layers of blame here, and they carry different weight.

The first came from industry. On the day of the theft, Elliptic said on-chain analysis and other information pointed to hackers affiliated with North Korea. That is an expert finding, not a court ruling.

The second came from governments. On January 14, 2025, the United States, Japan and South Korea issued a joint statement on North Korean cyber theft. Read the wording closely. In it, the United States and South Korea "additionally attribute" the $235 million WazirX theft to North Korea. They cite industry analysis. Japan co-signed the overall warning but is not named in that specific attribution. The statement does name the Lazarus Group as a North Korean actor. But it does not tie that group by name to WazirX.

So the North Korea crypto theft label is backed by two governments and several analysts. It is a strong attribution. Still, it rests on intelligence and blockchain tracing, not on charges against named people for this attack.

In India, The Record reported that Delhi Police arrested Masud Alam of West Bengal in November 2024. Police alleged he opened a WazirX account under a false name and sold it on Telegram. They said the account was later used in the breach. How that account fits with the multisig story has not been explained publicly. Treat it as an allegation, not a finding of guilt.

What Happened Afterwards?

The stolen funds moved fast. Elliptic noted that the thief swapped many tokens for ether soon after the theft, a common first laundering step. By mid-September 2024, more than 42,500 ETH had gone through the Tornado Cash mixer. That was worth about $100 million then, as The Block reported using Arkham data.

WazirX's parent company, Zettai, turned to a Singapore court process called a scheme of arrangement. A first version won creditor votes but was rejected because the company had not disclosed incorporation details of a Panama entity. A revised scheme passed in August 2025 and was sanctioned on October 13, 2025.

The exchange restarted on October 24, 2025. According to Outlook Money, it distributed about 85% of rebalanced net liquid platform assets within 10 business days. The remaining claim is represented by WazirX recovery tokens. These are allocated in proportion to each approved claim. Every three months, if at least $10 million has been recovered in that cycle, part of it buys back tokens. They were not tradable at the time of that report.

Seven Lessons From the WazirX Hack

This section is the heart of the report. Each lesson from the WazirX hack ties back to a fact above.

1. Verify the payload, not the picture. Multisig wallet security depends on each signer seeing the real transaction. Signers should check the raw details on a separate trusted device, or with an independent decoder, before approving.
2. Make signers truly independent. Four approvals through one shared interface act like one approval. Use different tools, networks or teams so a single bad screen cannot fool everyone.
3. Treat control changes as the highest risk. Whitelists protect payments, not the wallet's own rules. Any transaction that changes ownership, code or signer lists deserves a separate, slower approval path with a time delay.
4. Keep less in one wallet. Close to half of WazirX's reserves sat where one signing session could reach them. Splitting funds limits the damage of any single failure.
5. Agree on incident roles before you need them. WazirX and Liminal spent months blaming each other. Contracts with custody firms should say who investigates, who shares logs, and how findings go public.
6. Know Your Customer is a security control too. The Delhi arrest centered on an account allegedly opened under a false name and resold. Weak identity checks give attackers ready-made cover.
7. Plan for recovery, not only prevention. Users waited over a year for partial repayment. Insurance, cash reserves and a tested recovery plan decide how long customers wait.

What Does This Mean for Exchanges and Users in Pakistan?

Pakistan is now writing its own rules for crypto. In July 2025, the President signed an ordinance creating the Pakistan Virtual Assets Regulatory Authority (PVARA). Dawn reported that anyone offering virtual asset services in or from Pakistan must get a PVARA license. License holders also face compliance and reporting duties in line with FATF standards.

That matters because a license usually comes with security rules. Maybe you work at a local fintech, a software house that builds wallets, or a bank testing digital assets. If so, the WazirX case is a ready-made test. Ask whether your signers would spot a mismatched payload, and whether your contracts settle who investigates after a breach.

If you are an individual trader, the takeaway is calmer. Any crypto exchange hack hits customers who did nothing wrong. Leave on an exchange only the coins you actively trade. Protect your account with an authenticator app. Be wary of anyone who offers to "recover" frozen funds for a fee. Our WhatsApp account recovery checklist covers the same scam patterns that follow big hacks.

How Does WazirX Compare With Other Series Cases?

Seven months later, the Bybit hack showed a similar pattern. Signers approved a transaction that looked routine on screen but did something else. The Ronin Network hack also beat a multi-signature design, there by gaining enough validator keys. The Coincheck hack showed what happens when a large balance sits in a single hot wallet. Read together with the Binance hack case study, these cases share one theme. The weak spot is usually the approval process around the keys, not the math behind them.

How PSTA Students Work Through a Case Like WazirX

At PSTA, we use real incidents as teaching material. They show how defenses fail in practice. PSTA's beginner course in cyber security and ethical hacking lasts 12 weeks. It starts with core ideas such as the CIA triad and risk. Later modules cover typical attacks, beginner-level ethical hacking and network security. You also study malware, how threats are detected, cyber law and digital forensics.

In the labs, you work through a mock incident: you keep the evidence intact and build a dated record of events, much like the table above. Your final piece of work is a case-study project with a written report. Classes run online for learners anywhere in Pakistan, or on campus at Mandian, Old College Road, Abbottabad.

Already know the basics? Our advanced penetration testing course teaches authorized testing of real systems from an attacker's point of view. Message our team on WhatsApp about the next batch. They can tell you which track fits your level.

Make Your Next Approval a Slow One

The single habit that would have helped most here is cheap. Next time you approve any payment, from a company wallet or a bank app, pause first. Confirm the details through a second channel, then sign. A two-minute check is far less costly than a year of frozen withdrawals.