$230 Million WazirX Hack Potentially Linked to Lazarus Group, Say Blockchain Researchers

India’s largest crypto exchange lost $230 million in a security breach – blockchain sleuth ZachXBT said the hack “has the potential markings of a Lazarus Group attack.”

WazirX, the largest crypto exchange in India, lost nearly half of its total assets after a security breach on Thursday.

“We’re aware that one of our multisig wallets has experienced a security breach. Our team is actively investigating the incident. To ensure the safety of your assets, INR and crypto withdrawals will be temporarily paused,” said the WazirX team on X.

Blockchain analytics platform Arkham estimated that $235 million worth of funds was stolen by the hackers, sharing a list of wallet addresses associated with the malicious actors activity onchain.

The WazirX team later shared an update with its preliminary findings on how the attack transpired – by their estimates, the loss of funds exceeded $230 million. The team said the cyberattack targeted one of its multisig wallets, which utilized Liminal’s digital asset custody and wallet infrastructure services.

WazirX noted that root cause of the attack stemmed from a mismatch between the information displayed on Liminal’s interface and what was actually signed.

“We had robust security features, including the Gnosis Safe multisig smart contract platform and Liminal’s whitelisting policy. Despite us taking all necessary steps to protect the customer assets, the cyber attackers appear to have possibly breached such security features, and the theft occurred,” said the WazirX team.

“This is a force majeure event beyond our control, but we are leaving no stone unturned to locate and recover the funds.”

As for the identity of the hacker, blockchain security researchers had one common theory – the North Korean State-sponsored Lazarus Group.

Polygon’s chief information security officer Mudit Gupta found that the attackers had started practicing the attack onchain at least eight days ago, noting that the “methodical and organized” nature of the hack pointed towards the North Korean hackers.

Blockchain sleuth ZachXBT arrived at a similar conclusion after tracing the hacker’s activity.

“All I can say is the WazirX hack has the potential markings of a Lazarus Group attack (yet again)” said ZachXBT on X.