Recently, WazirX conducted a preliminary investigation into a sophisticated cyber attack on its multi-signature Ethereum wallet. The attack raised concerns within the crypto community, as it targeted the exchange’s signers and a custody service provider, Liminal. The investigation revealed that compromised hardware wallets were likely the cause of the breach, contradicting the initial belief that the issue stemmed from Liminal’s user interface.
WazirX highlighted two possible scenarios to explain the breach. The first scenario involves a breach within Liminal’s infrastructure, where malicious transactions were received directly from Liminal due to a compromise of their system. The absence of new connection requests to hardware wallets and the use of whitelisted addresses support this theory. The second scenario focuses on a compromise of WazirX signers’ devices by malware. However, there is no concrete evidence to support this hypothesis, and it would require a breach of Liminal’s firewall to obtain the final signature.
Despite rigorous security measures in place, the attack utilized legitimate signatures, indicating a potential breach within Liminal’s system. The malicious transactions did not originate from WazirX servers, suggesting a breach of Liminal’s security protocols. The incident underscores the challenges of securing multi-signature wallets, particularly the risks associated with blind signing, where hardware wallets do not display transaction details.
The cyber attack on WazirX resulted in the theft of approximately 45% of the crypto it held, leading to a temporary halt in operations. However, the exchange assured users that their fiat currency deposits remained safe. WazirX is currently working with relevant authorities to resume services and exploring partnerships to compensate affected customers. Cybersecurity experts have speculated the involvement of the North Korean Lazarus Group, known for sophisticated attacks on financial institutions and crypto exchanges.
The WazirX cyber attack highlights the evolving challenges of securing multi-signature wallets in the crypto industry. While the exchange had implemented industry-standard best practices, the breach exposed vulnerabilities in their system and the risks associated with blind signing. Moving forward, it is crucial for exchanges to continually assess and enhance their security measures to protect users’ assets and maintain trust within the community.