WazirX crypto exchange hack and its bounty programme: what it means to India’s crypto investors? Premium

WazirX responds to $230M cyberattack with bounty programmes for ethical hackers to recover stolen funds.

On July 18, Indian cryptocurrency exchange WazirX was hit by a cyberattack that led to a loss of digital assets worth more than $230 million from one of its wallets. The exchange responded by pausing normal trading activities and reported the incident to the Indian authorities and other crypto exchanges. The company also launched two bounty programmes aimed at ethical hackers who can help the exchange track, freeze and recover the stolen funds.

WazirX said there was a cyberattack against a multi-signature wallet it managed through a digital asset custody service known as Liminal. Multi-signature wallets have a built-in security feature that requires several parties to sign off on transactions.

“The impact of the over $230M cyberattack is on the digital assets of our customers,” said WazirX in a blog post, adding that INR funds were not affected. The company strongly denied that WazirX itself was breached, and brushed aside rumours that it was duped by a phishing attack.

The exchange also noted that it was “certain” that its hardware keys were not compromised, adding that an external forensic team would be engaged to further investigate the matter.

But Liminal, after completing investigations at its end, said “It is evident that the genesis of this hack stems from three compromised devices at WazirX’s end.”

Meanwhile, WazirX founder and CEO Nischal Shetty said that the attack was only possible if there had been four points of failure in the digital signing process.

WazirX has not yet revealed the suspected parties or perpetrators responsible for the hack. However, news reports have emerged that North Korean hackers were responsible for the incident.