WazirX

Profile narrative

WazirX is a cryptocurrency exchange headquartered in India. It operates an online platform that enables users to buy, sell, and trade a variety of digital assets. The platform supports major cryptocurrencies and numerous tokens. In addition to trading, WazirX provides custodial wallet services that allow customers to store their holdings within the exchange’s infrastructure. These wallet services are secured through a multisignature arrangement that involves multiple approvals before any transaction can be executed. Users can access the exchange through a web‑based interface as well as mobile applications. The service is designed to facilitate the conversion of digital assets and to provide liquidity for traders operating in the Indian cryptocurrency market.

A distinguishing attribute of WazirX’s security model is its use of a multisignature wallet that required three approvals from WazirX signatories employing Ledger hardware wallets, followed by a final authorization from Liminal’s custody infrastructure. This architecture incorporated address whitelisting, meaning that funds could only be sent to pre‑approved destinations, and relied on Gnosis Safe protocols to enforce transaction policies. In July 2024, attackers exploited a discrepancy between the information displayed by Liminal’s user interface and the actual transaction data being signed. By manipulating the displayed payload, the attackers were able to substitute a malicious transaction that redirected over $230 million of assets to addresses outside the whitelist. Despite the existing safeguards, the exploit allowed the theft to proceed, prompting WazirX to halt suspicious deposits and to engage external forensic teams to trace the stolen funds. The exchange has communicated that it is working with law enforcement and blockchain analysts to attempt recovery of the stolen cryptocurrency. No public information has been released regarding any changes to WazirX’s ownership, parent company, or subsidiary structure following the incident.

Incidents

1 incident linked to this organisation.