WazirX Security Breach: $230M Lost, Linked to North Korean Hackers
Indian cryptocurrency exchange WazirX suffered a catastrophic security breach on July 18, 2024, losing approximately $230 million in digital assets. The attack, now attributed to North Korea’s Lazarus Group, prompted temporary suspensions of INR and crypto withdrawals, highlighting vulnerabilities in centralized exchanges.
What Happened? The WazirX Security Breach
Unauthorized Transfers Detected
WazirX detected suspicious activity in its multisignature (multisig) wallet, a security feature requiring multiple approvals for transactions. However, attackers bypassed these protections, leading to unauthorized withdrawals totaling $230 million.
Key Stolen Assets:
- Shiba Inu (SHIB): $102 million
- Ethereum (ETH): $52.5 million
- Polygon (MATIC): $11.24 million
- Pepe Coin: $7.6 million
- Tether (USDT): $135 million
- Gala (GALA): $3.5 million
Investigations revealed that the attack exploited WazirX’s custodial service provider, Liminal, allowing hackers to manipulate wallet controls and authorize large transfers.
North Korea’s Lazarus Group Behind the Attack
Attribution to Lazarus Group
Blockchain security firms like Elliptic and Chainalysis linked the WazirX breach to Lazarus Group, North Korea’s state-sponsored hacking collective. This group has stolen over $659 million in cryptocurrencies in 2024 alone, with WazirX accounting for $235 million of that figure.
Why is Lazarus Targeting Crypto?
North Korea uses stolen cryptocurrencies to fund its nuclear and weapons programs, bypassing global sanctions. Lazarus has been behind several high-profile hacks, including:
- Axie Infinity’s Ronin Bridge Hack (2022) – $620M stolen
- Harmony’s Horizon Bridge Hack (2022) – $100M stolen
- Atomic Wallet Exploit (2023) – $100M stolen
The WazirX attack follows the same pattern of sophisticated social engineering and private key compromise, a known Lazarus tactic.
How WazirX Responded to the Breach
Suspending Withdrawals
Immediately after detecting the breach, WazirX halted all INR and crypto withdrawals to prevent further unauthorized transactions. Users were left in limbo, unable to access funds.
User Compensation Plan: A Socialized Loss Approach
To address the massive loss, WazirX implemented a “socialized loss” strategy, affecting all users:
✅ 55% of holdings were returned to customers
⛔ 45% of assets were locked in USDT-equivalent tokens
This controversial move meant that even users who weren’t directly affected by the hack saw their balances reduced.
Security Implications: What This Means for Crypto Users
1. Centralized Exchanges Remain Vulnerable
The WazirX hack underscores the risks of keeping funds on centralized exchanges. Unlike decentralized wallets, CEXs are prime targets for large-scale cyberattacks.
2. The Importance of Self-Custody
Given rising exchange hacks, security experts recommend:
✅ Using hardware wallets (Ledger, Trezor) for large holdings
✅ Spreading funds across multiple exchanges instead of relying on a single platform
✅ Enabling multi-factor authentication (MFA) for account security
3. Regulatory and Compliance Challenges
Governments are increasing pressure on exchanges to implement stronger security standards and insurance policies. However, many platforms lack adequate consumer protection measures, leaving users vulnerable when breaches occur.
Final Thoughts: Lessons from the WazirX Hack
The $230M WazirX hack is a stark reminder of the ongoing security threats facing cryptocurrency exchanges. While WazirX’s recovery efforts attempt to minimize damage, the attack highlights the growing sophistication of state-sponsored hackers like Lazarus Group.
For crypto users, this incident reinforces the importance of security best practices—particularly self-custody and diversified asset storage—to protect funds from exchange vulnerabilities.
As regulatory scrutiny intensifies, the future of centralized exchanges will depend on their ability to implement stronger safeguards and restore user trust.
