Major security breach at Indian crypto exchange WazirX, over $230 million withdrawn

Indian cryptocurrency exchange WazirX experienced a significant security breach on Thursday, leading to over $230 million in withdrawals. This breach affected one of its multisig wallets, causing a substantial loss of user funds.

WazirX acknowledged the breach in a post on X (formerly Twitter), stating: "We're aware that one of our multisig wallets has experienced a security breach. Our team is actively investigating the incident. To ensure the safety of your assets, INR and crypto withdrawals will be temporarily paused. Thank you for your patience and understanding. We'll keep you posted with further updates."

The exchange confirmed the incident, noting that they are investigating the outflows and have temporarily suspended all withdrawals. They added: "We have identified two more exploited smart contracts. Our team is still investigating the incident. For the time being, we have opened up a secluded website to revoke all approvals. Your funds are at risk until you revoke."

Liminal Custody, a Singapore-based digital asset custody and wallet infrastructure platform, has also put out a statement clarifying that the multi-sig smart contract wallets created outside of Liminal ecosystem were impacted. 

Liminal Custody statement read, "Our preliminary investigations show that one of the self-custody multi-sig smart contract wallets created outside of the Liminal ecosystem has been compromised. We can confirm that Liminal’s platform is not breached and Liminal’s infrastructure, wallets and assets continue to remain safe."

The statement further added, "It is also pertinent to note that all WazirX wallets created on the Liminal platform continue to remain secure and protected. Meanwhile, all the malicious transactions to the attacker’s addresses have occurred from outside of the Liminal platform. Adhering to our rigorous security protocols, the Liminal team is also readily assisting the WazirX team as they carry out their investigation."

Understanding Multisig Wallets
Multisig wallets require two or more private keys to authenticate and confirm transactions. This added layer of security is designed to protect user funds, but it seems to have been compromised in this instance.