The Indian cryptocurrency exchange WazirX suffered one of the largest centralized exchange hacks of 2024 when attackers compromised a multisig wallet on July 18, siphoning over $230 million in digital assets. As the fallout continues into September, the incident serves as a stark reminder that centralized platforms remain the weakest link in the crypto security chain, with an estimated $636 million of the $1.19 billion stolen across all of 2024 originating from centralized finance vulnerabilities.
The Exploit Mechanics
The WazirX attack targeted a multisignature wallet managed through a partnership with the digital asset custody provider Liminal. The attackers exploited vulnerabilities in the multisig wallet’s smart contract implementation, allowing them to bypass the required multiple authorization signatures. Once inside, the hackers systematically drained assets including Ethereum, Solana, and various ERC-20 tokens worth approximately $230 million at the time of the breach.
By early September, blockchain analytics firms confirmed that the WazirX hacker had begun moving stolen funds through Tornado Cash, the Ethereum-based privacy mixer that has become a favored tool for laundering stolen cryptocurrency. On September 2, 2024, on-chain monitoring services detected the first significant transfers to Tornado Cash, indicating that the attacker was actively attempting to obscure the trail of stolen assets. The laundering process has reportedly progressed rapidly, with estimates suggesting that the majority of the stolen funds have already been processed through mixing services.
Affected Systems
The breach specifically impacted one of WazirX’s multisig wallets, which was supposed to provide enhanced security through distributed key management. However, the attack revealed that even multisig configurations can be compromised when smart contract-level vulnerabilities exist. The stolen assets represented nearly half of WazirX’s total reserves, leaving the exchange severely undercapitalized and unable to process user withdrawals at full value.
The cascading effects extended beyond WazirX itself. Indian cryptocurrency users, who had already endured regulatory uncertainty, faced a crisis of confidence in centralized platforms. Multiple other exchanges operating in the region reported increased withdrawal requests as users sought to move assets to self-custody solutions. The broader market also felt the impact, with Bitcoin trading around $57,300 and Ethereum at approximately $2,430 at the beginning of September — both well below their recent highs, partly attributed to shaken investor confidence.
The Mitigation Strategy
In response to the breach, WazirX initiated a restructuring process through its Singapore-based parent entity Zettai Pte. Ltd. The exchange temporarily suspended withdrawals while working with cybersecurity firms and law enforcement to trace the stolen funds. The company also engaged blockchain analytics providers to monitor the movement of compromised assets across decentralized exchanges and mixing protocols.
For the broader industry, the incident underscores the critical importance of implementing robust custody solutions that go beyond basic multisig configurations. Security experts now recommend that exchanges adopt hardware security modules (HSMs) with threshold signature schemes, implement real-time transaction monitoring with automated pause mechanisms, and conduct regular penetration testing of all smart contract infrastructure. The use of modular custody architectures, where different asset pools are isolated from one another, can also limit the blast radius of any single compromise.
Lessons Learned
The WazirX hack reinforces several critical lessons for both platforms and users. First, the concentration of assets in centralized exchanges creates an inherently attractive target for sophisticated attackers. When a single platform holds hundreds of millions of dollars in user funds, the incentive for exploitation grows proportionally. Second, multisig wallets alone are not sufficient protection — the implementation quality of the underlying smart contracts matters just as much as the key distribution scheme.
Third, the speed at which stolen funds can be laundered through mixing services highlights the need for faster response protocols. By the time many breaches are detected, attackers have already begun the laundering process. Fourth, regulatory frameworks matter. The WazirX incident has intensified discussions in India and beyond about the need for mandatory security standards for cryptocurrency custody providers.
User Action Required
Crypto users should take immediate steps to protect their assets following this breach. Move funds off centralized exchanges unless actively trading. Use hardware wallets from reputable manufacturers for long-term storage. Enable all available security features on exchange accounts, including two-factor authentication and withdrawal whitelist restrictions. Regularly review token approvals on your wallets and revoke any unnecessary permissions that could be exploited in phishing attacks. Finally, stay informed about security incidents through blockchain monitoring services and adjust your custody strategy accordingly.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making cryptocurrency-related decisions.
230M and they couldnt even manage a proper multisig setup. the Liminal custody angle makes it worse, supposed to be the security partner
liminal was supposed to be the institutional-grade custody layer. when your security partner is the attack vector you have a fundamental trust problem
Liminal being the attack vector is the worst case. your security partner failing means the entire custody stack is compromised
Ngozi E. Liminal being the weak link is the scariest part. you hire a custody partner specifically to avoid this and they become the attack vector
230M through Tornado Cash and the funds still havent moved. either the hacker is patient or law enforcement is actually freezing wallets faster now
WazirX users still waiting for answers months later. The lack of transparency from the team has been worse than the hack itself.
230M drained and WazirX users are still waiting for a restructuring plan a year later. the lack of any recovery roadmap is worse than the hack itself
Fatima A. users waiting months for answers while the team hides behind legal process. WazirX transparency has been zero since day one
636M out of 1.19B stolen from CeFi in 2024. centralized exchanges are the real security risk, not DeFi
$636M from CeFi in 2024 alone. at some point the not your keys not your coins crowd has a point
hot_wallet_ 636M from CeFi in one year and people still keep bags on exchanges. not your keys is a cliché because its true
$230M gone because the multisig setup with Liminal had a flaw. custody providers need to be audited as thoroughly as the exchanges themselves
liminal was their custody partner and the smart contract exploit bypassed the multisig entirely. your custody provider becoming the attack vector is the worst case scenario for any exchange
multisig_graveyard the fact that funds went straight to Tornado Cash and nobody could freeze them tells you everything about the state of CEX security in 2024
Anika R. funds going to Tornado Cash and nobody could freeze them. the OFAC sanctions on TC literally happened because of cases exactly like this
multisig_graveyard the Liminal setup had a flaw in the smart contract logic not the multisig itself. your custody partner is another attack surface nobody audits
230m from wazirx multisig and tornado cash moving the funds within days
636m stolen from cefi in 2024 and custody partners keep failing, liminal was supposed to be safe
users locked out of funds for months with zero recovery plan. at least with defi exploits the code is transparent and you know where things stand
Liminal pointing at WazirX while WazirX points back. $230M gone and customers get a joint press release instead of answers
custody_chain_kep the Liminal smart contract flaw means any exchange using that custody stack was exposed. WazirX was just the first victim
funds hitting Tornado Cash within weeks. planned op not opportunistic. the multisig was cased before the exploit fired
NASAA pushing back hard on those market structure bills makes sense if states want to keep enforcement power, but it feels like it could slow down real progress for crypto.
Comment on article 69003
30M breach on WazirX is a wake-up call for all centralized platforms.
230M drained from a multisig and Liminal is pointing fingers at WazirX while WazirX blames Liminal. customers are stuck holding the bag while two custody providers play hot potato with liability
the fact that they were moving stolen funds through Tornado Cash a month later tells you this was a planned operation not some opportunistic grab. the multisig vulnerability was scouted well in advance