WazirX Hacker Converts Majority of Stolen $234M Assets into Ether

One of India’s largest crypto exchanges WazirX suffered a security breach that drained $234 million of users funds yesterday. The incident, which targeted the exchange’s multisig wallet on the Ethereum network, saw the theft of over 200 different crypto assets, including Shiba Inu, Ethereum, Polygon, and PEPE memecoin.

Blockchain analytics firm Lookonchain revealed on Thursday night via X that the hacker responsible for this massive heist has converted the majority of the stolen assets into ether (ETH).

According to Lookonchain, the exploiter exchanged the funds for 43,800 ETH, valued at approximately $149.46 million. The hacker’s wallet currently holds around 59,097 ETH, with an estimated value of $201.5 million at the time of writing.

The #WazirX exploiter has exchanged most of the assets for 43,800 $ETH($149.46M) and currently holds 59,097 $ETH($201.67M).

Currently, there are ~$15M assets left. Including:
1.66B $DENT ($1.56M)
6.76M $CHR ($1.72M)
78.6M $CELR ($1.12M)
958,428 $FRONT ($909K)
…

It is worth… pic.twitter.com/MX9uvt3BpV

— Lookonchain (@lookonchain) July 19, 2024

Hacker Still Holds $15 Million in Different Coins

In addition to the ether, the hacker’s wallet retains about $15 million in various cryptocurrencies, including Dent, Chromia, Celer Network, and Frontier tokens. Lookonchain also noted an unusual transaction involving the deposit of 7.7 million Dent tokens (worth $7,300) to a previously unused Binance deposit address.

The breach has prompted WazirX to halt all withdrawals as they investigate the security lapse. In a detailed official statement, the exchange noted that the cyber attack stemmed from a discrepancy between the data displayed on Liminal’s interface and the transaction’s actual contents. During the cyber attack, there was a mismatch between the information displayed on Liminal’s interface and what was actually signed.

In an emailed statement to CryptoNews, Liminal Custody clarified,

“Our preliminary investigations show that one of the self-custody multi-sig smart contract wallets created outside of the Liminal ecosystem has been compromised. We can confirm that Liminal’s platform is not breached and Liminal’s infrastructure, wallets and assets continue to remain safe.”

The exact method of the hack remains under investigation, but initial reports from blockchain analytics firm Elliptic suggest the involvement of hackers linked to North Korea.

Elliptic’s report highlights that on-chain data points to techniques commonly used by North Korean hackers, who have a history of targeting cryptocurrency exchanges to fund the regime. This breach adds to a series of high-profile hacks in the cryptocurrency sector, raising concerns about the security of digital asset exchanges.