WazirX crypto exchange confirmed on Thursday that one of its multi-signature wallets had suffered a security breach. The Indian exchange was first alerted to the potential breach by security firm Cyvers Alerts via a post on X. Cyvers noted in its post that $234.9 million (approximately Rs. 1,965 crore) had been suspiciously moved off the exchange to a new address linked to controversial crypto mixer platform, Tornado Cash.
In an official statement regarding the incident, WazirX said: “We are aware that one of our multisig wallets has experienced a security breach. Our team is actively investigating the incident.” WazirX has suspended all withdrawal and deposit services on its platform for the time being.
According to Cyvers, the address to which WazirX funds were moved has already managed to convert PEPE, GALA, and USDT tokens into Ether. In a screenshot shared by the security firm, the malicious actor moved the hefty sum via three transactions, with the exploit level listed as “critical” on Cyvers’ software.
:rotating_light:ALERT:rotating_light:Hey @WazirXIndiaOur system has detected multiple suspicious transactions related to your Safe Multisig wallet on the #ETH network.
A total of $234.9 million of your funds have been moved to a new address. The caller of each transaction is funded by @TornadoCash.
The suspect… photo.twitter.com/4sajAwd4Hb
— :rotating_light: Cyvers Alerts :rotating_light: (@CyversAlerts) July 18, 2024
Gadgets360 reached out to Cyvers to learn more about the breach and has yet to hear an explanation of how a multi-sig wallet became the hotspot for this attack in the first place. Multi-signature wallets require two or more private keys (signatures) from different co-signers to authorize a transaction.
WazirX has yet to comment on the safety of user funds stored on the platform, despite several users asking about it in the exchange’s situation update on X. The crypto exchange is also yet to confirm the amount of money allegedly moved from the platform to the suspicious address.
“Thank you for your patience and understanding. We will keep you updated with further updates,” the platform said.
Are the user’s funds safe?
— Zia ul Haque (@ImZiaulHaque) July 18, 2024
According to its blog, WazirX has a user base of over 16 million. Earlier in June 2024, the exchange had published the latest certificate of reserve showing that the total assets were worth Rs 4,203 crore.
The report at the time claimed that WazirX maintained a reserves-to-liabilities ratio of over 1:1 to meet withdrawal requirements even in unforeseen circumstances
