Writing

WazirX, July 2024: what the public record says about the withdrawal path

12 November 2026 · Prasanta Sahoo

The two parties closest to the wallet each publish an account, and the accounts place the compromise in different locations. Neither published account includes the forensic report behind it.

On 18 July 2024 WazirX, an Indian exchange, reported “a loss of funds exceeding $230 million” from one of its multisig wallets. WazirX states the wallet ran on the custody and wallet infrastructure of Liminal, with six signatories (five from WazirX, one from Liminal). WazirX attributes the loss to a discrepancy between what Liminal’s interface displayed and what the transaction contained. Liminal states that its own platform and infrastructure were not compromised and describes a compromise at the customer level.

This note separates what the sources state from what they do not, then lists the questions a withdrawal-path review asks of any exchange with a similar structure. Every statement is tagged by source, and where the two parties disagree each is reported in its own words. This note does not take a side and does not state a cause. Nothing here is a finding about the internal controls of any named company beyond what a source says.

What the sources state

DateWhatSource
February 2023WazirX says it started using Liminal in February 2023 and that Liminal’s key was added to the smart contract then. Liminal says the wallet was independently created and subsequently imported onto its platform (no date given).WazirX day-wise report; Liminal statement of 29 Jul 2024
Before the incident (undated)WazirX describes six signatories. A transfer needed three WazirX approvals, each on a Ledger hardware wallet, then Liminal’s final signature. A destination whitelist was in place.WazirX preliminary report of 18 Jul 2024; WazirX “Key Insights and Learnings” of 25 Jul 2024
18 Jul 2024, 06:20:23 UTCEtherscan shows a successful transaction (block 20331578) from an address it tags “WazirX Exploiter 5” to the wallet address WazirX names, which Etherscan tags “WazirX 2” and shows as a Safe smart account. The transaction carries an internal transfer of 15,298.16 ETH to an address tagged “WazirX Exploiter”. This is one transfer, not a total.Etherscan (tags are Etherscan’s)
18 Jul 2024WazirX reports the loss and says the attack “stemmed from a discrepancy between the data displayed on Liminal’s interface and the transaction’s actual contents”. It says it suspects “the payload was replaced to transfer wallet control to an attacker”, and calls the event “a force majeure event beyond our control”.WazirX preliminary report
18 Jul 2024WazirX says attacker transactions are visible “after 18th July, 11:45 AM” (no timezone stated) and that withdrawals were stopped at 1 PM IST. Liminal says it was notified of the incident on 18 July.WazirX day-wise report; Liminal statement of 29 Jul 2024
25 Jul 2024WazirX says it has found no evidence that its signers’ machines were compromised, that the signing hardware did not display the token or destination address so signers relied on Liminal’s website, and that it currently believes the more likely cause is malicious transactions received from Liminal, pending Liminal’s analysis.WazirX “Key Insights and Learnings”
29 Jul 2024Liminal says its platform, infrastructure, wallets and assets “remain completely secure”, that its preliminary investigation “points to a customer level compromise via a sophisticated intrusion”, and that it engaged independent CERT-certified experts for forensic audits.Liminal statement of 29 Jul 2024
5 Aug 2024An FIR was registered at PS Special Cell, Lodhi Colony, New Delhi, on WazirX’s complaint. No suspect is named.WazirX post of 6 Aug 2024
14 Aug 2024 (report); 19 Aug 2024 (release)WazirX says an unnamed cybersecurity and investigations firm reported that it “did not identify evidence of compromise on the three laptops that were used for signing transactions”. The release does not say whether Liminal’s systems were examined.WazirX release of 19 Aug 2024
27 Aug 2024WazirX’s parent, Zettai, applied to the High Court of Singapore for a moratorium (HC/OA 861/2024).WazirX post of 28 Aug 2024
22 Oct 2024Liminal says its contract with WazirX was a software subscription, that only the WazirX team can initiate transactions on the wallets, and that Liminal cannot initiate or transfer funds.Liminal statement of 22 Oct 2024
14 Jan 2025WazirX says a joint US, Japan and South Korea statement linked North Korea to thefts including “$235M tied to WazirX”. The statement itself was not read.WazirX day-wise report
23 Jan 2025WazirX reports that the Singapore court found no proper or sufficient evidence of wrongdoing by Zettai, contrary to suggestions that it orchestrated the attack. This is WazirX’s report of the court; no court document is linked.WazirX post of 23 Jan 2025
18 Jul 2025WazirX says law enforcement including the FBI traced the attack to the North Korean Lazarus group, and that it works with zeroShadow and Kroll.WazirX one-year post

Where the sources differ

This incident has a public disagreement between the exchange and its custody provider. Each party’s position is given as it states it.

Where the compromise arose. WazirX states that the attack stemmed from a discrepancy between the data displayed on Liminal’s interface and the transaction’s contents, and on 25 July says it believes the more likely of two scenarios is that signers received malicious transactions directly from Liminal because of a potential breach of Liminal’s infrastructure, pending Liminal’s analysis. Liminal states that its platform and infrastructure remain secure and that its preliminary investigation points to a customer-level compromise. On 22 October Liminal compares the case to a different incident, Radiant Capital, and says the transaction information there was altered by malware on signers’ devices. WazirX states that it found no evidence of compromise on its signers’ machines, and that an unnamed firm found none on the three signing laptops. Neither party publishes the underlying forensic report in the pages read.

How the wallet came to be on Liminal. WazirX says Liminal’s key was added to the contract when it began using Liminal in February 2023. Liminal says the wallet was independently created and then imported onto its platform. Neither states the order or date of those steps.

Liminal’s role in a transfer. WazirX describes Liminal’s signature as the fourth and final one and Liminal’s signer as “the last line of defense”. Liminal states that in this product it “can never initiate a transaction”, and that most keys are operated by the client with Liminal holding one signer key.

Contract upgrade. WazirX says the transaction “seemed to have upgraded the contract to transfer the control to the attacker” and reports that Liminal told it its interface does not allow initiating a contract upgrade. The Liminal pages read do not address upgrades.

Points only one party makes. Liminal states that WazirX did not use several Liminal offerings, including hot wallets, and that WazirX announced on 14 August 2024 that it had terminated the contract, after a social-media post it says was made hours after the incident and later retracted. The WazirX pages read do not address these points; the post and the announcement were not read.

Smaller differences. WazirX gives “exceeding $230 million” and, citing the joint statement, $235M. WazirX’s day-wise report places a cybercrime-portal complaint on 18 July and its FIR post places a police complaint on 19 July. WazirX’s 11:45 AM carries no timezone; Etherscan’s timestamp for the transaction above is 06:20:23 UTC.

What the sources do not say

What the sources say about controls

WazirX describes: a six-signer multisig with three WazirX approvals plus a final Liminal signature; Ledger hardware wallets; signers at three locations on three internet connections, two using devices primarily dedicated to signing; mandatory two-factor authentication on Liminal’s website; and a destination whitelist that, it says, Liminal enforces. WazirX also says the hardware device does not display the token or destination address, so signers relied on the transfer details on Liminal’s website, and that the malicious transaction was not sent to any whitelisted address. Its stated lessons include that if a custody provider’s infrastructure is compromised, displayed transaction information could in theory be manipulated, and it lists mitigations including hardware wallets, geographically distributed signers and bookmarked links.

Liminal describes a self-custody product in which the client holds most keys and Liminal one, in which Liminal cannot initiate transactions, and says WazirX’s wallets were provided as cold and warm wallets with one low-balance hot wallet. These are each party’s statements, not findings by either.

Questions a withdrawal-path review asks

These are the questions we put to any exchange whose wallet uses a multisig with a third-party custody or interface provider. They are our analysis of a structure the public record describes, not a statement that any company lacked a control.

1What does each signer see when approving, and on which device? Can the signer read the destination, amount, asset and call data on a screen that the interface provider cannot alter?
2Who verifies that what was signed equals what was approved, and where is that check performed? Is it independent of the provider whose interface displayed the request?
3Can any signed message change the wallet itself, for example its logic, owners or threshold, and not only move funds? What blocks or flags that class of transaction?
4What does a provider-held signature add? Does the provider independently check the transaction content and the whitelist, and is that check separate from the interface the other signers use?
5If the interface provider or one signer is compromised, what is the smallest number of further failures needed to move funds, and are those failures independent?
6Would the exchange detect a transfer or a wallet change before or within minutes of broadcast, and what limits, holds or circuit-breakers apply to a very large outflow? After an incident, which party holds the logs and signing evidence, and was access to them agreed in advance?

Sources

Quotations and dates are as printed in the sources; where a source shows no timezone, none is assumed. Several WazirX pages also display later dates that the pages do not explain. If you represent a company named here and see an error, write to research@deebug.io and we will correct it.