The cryptocurrency world woke up to alarming news on July 18, 2024, as Indian exchange WazirX disclosed a catastrophic security breach that resulted in the theft of approximately $230 million in digital assets. The attack targeted a multi-signature wallet managed through third-party custody provider Liminal, exposing critical vulnerabilities in how even well-protected exchange infrastructure can be compromised through interface-level manipulation.
The Exploit Mechanics
According to WazirX preliminary findings, the attack exploited a discrepancy between the information displayed on Liminal custody interface and the actual transaction payload being signed. The attackers manipulated what signers saw on screen, causing them to authorize malicious transactions that transferred wallet control to the attacker. This technique, known as a front-end manipulation attack or UI spoofing, is particularly dangerous because it bypasses the hardware and process-level security measures that multi-signature setups are designed to enforce.
Blockchain analysis from CloudSEK indicates the attackers may have been preparing for this assault for eight days prior to execution. The affected wallet, operating on Ethereum with ERC-20 tokens, was drained at approximately 06:19 UTC on July 18. The perpetrators gained unauthorized access to multiple keys required for authorizing transactions within the targeted multisig wallet. The stolen funds represented nearly half of WazirX total holdings, which stood at approximately $503 million according to their most recent proof-of-reserve report.
Affected Systems
The compromised wallet at address 0x27fD43BABfbe83a81d14665b1a6fB8030A60C9b4 held a diverse portfolio of digital assets. Bitcoin was trading at approximately $63,974 at the time, while Ethereum hovered around $3,426. The attackers siphoned a mix of major cryptocurrencies and ERC-20 tokens. WazirX immediately halted all crypto and rupee withdrawals following the breach discovery.
The attack bears hallmarks of previous campaigns by the Lazarus Group, a North Korean state-sponsored hacking collective. This suspicion stems from similarities in tactics and the identification of the attacker KYC wallet on the Binance exchange. In 2024 alone, North Korean hackers allegedly stole $1.34 billion across 47 incidents, with private key compromises accounting for 43.8 percent of all cryptocurrency thefts during the year.
The Mitigation Strategy
The attackers employed sophisticated obfuscation techniques to hinder recovery efforts. These included transferring stolen funds across multiple blockchain networks through chain hopping, fragmenting large sums into smaller transactions involving various cryptocurrencies, and executing transactions designed to generate zero ETH balances or spoofed transaction tokens. This multi-layered laundering approach significantly reduced the probability of fund recovery.
WazirX engaged multiple blockchain forensic firms and law enforcement agencies to trace the stolen assets. However, the rapid and complex laundering process made full recovery unlikely. The exchange advised users to remain vigilant against phishing attempts, as scammers quickly deployed lookalike domains mimicking the legitimate WazirX platform to target victims seeking refunds or asset recovery information.
Lessons Learned
The WazirX incident underscores several critical security lessons for the cryptocurrency industry. First, multi-signature wallets are only as secure as the interface through which transactions are verified. If the display layer can be compromised, the additional signatories provide a false sense of security. Second, third-party custody solutions introduce additional attack surfaces that exchanges must continuously audit and monitor. Third, the growing sophistication of state-sponsored hacking groups requires equally sophisticated defensive measures, including real-time transaction simulation and independent verification systems.
User Action Required
For WazirX users, the immediate priority is to avoid engaging with any unofficial communication channels promising refunds or asset recovery. Legitimate updates come only through official WazirX channels. For the broader crypto community, this incident serves as a stark reminder to diversify custody across multiple platforms, utilize hardware wallets for long-term holdings, and verify transaction details through multiple independent channels before signing. As Bitcoin trades near $64,000 and the total crypto market cap exceeds $2.4 trillion, the incentive for sophisticated attacks will only increase.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making any financial decisions.
230M stolen and Liminal had 8 days to catch it. their SOC team either had no alerting on API call anomalies or was ignoring them. either way that custody partnership is over
8 days of recon before the attack. that is not opportunistic, that is a professional operation. probably Lazarus based on the methodology
CloudSEK traced the prep work back 8 days. imagine what we could catch if exchanges shared threat intel in real time instead of post mortem reports
thats why you need to decode the raw calldata on a separate device. trust nothing between you and the blockchain
decoding calldata separately is great until you realize most signers cant read hex. the UX problem is the bottleneck, not the tech
calldata_check most signers cannot read hex but that is a skill issue not a UX issue. if you are signing a 230M transaction you should be able to decode the payload or you should not be signing
raw_calldata_ saying signers should be able to decode hex for a 230M tx is harsh but fair. if you cant read the payload dont sign
Lazarus has been doing UI spoofing attacks since the Ronin bridge. exchanges should have threat models for this by now
Svetlana G. Lazarus has been doing this since 2022 and exchanges still dont have proper multisig UI verification. $230m lesson
lazarus targets multisig because thats where the big money is. single sig hot wallets get drainer attacks, multisig gets state-sponsored UI spoofing
state-sponsored UI spoofing bypasses every hardware wallet on the planet because the display layer itself is compromised before the transaction ever reaches your device
Priya Nair is spot on about Lazarus using UI spoofing since 2022. Exchanges still don’t have proper multisig UI verification – $230M lesson that seems to never get learned.
yolotrade 8 days of recon and nobody flagged unusual API calls. basic threat monitoring should catch that kind of persistence
msig_paranoid_ makes a good point about the 8 days of recon. Basic threat monitoring should catch that kind of persistence, yet nobody flagged unusual API calls at Liminal.
security_pro_ the signing workflow being the real attack surface is exactly right. Liminal built a pretty UI that showed signers whatever the attacker wanted. the crypto was never broken, the display layer was
230M gone because the multisig signers saw different data than what was actually being signed. hardware wallets dont help if the UI is lying to you
ui_spoof_ 8 days of preparation and nobody at Liminal noticed the anomalous transactions. the monitoring failure is worse than the exploit itself
this is why I keep saying multisig is not a silver bullet. the signing workflow UX is the actual attack surface, not the cryptography
Devon Walsh’s point about multisig not being a silver bullet is crucial. The signing workflow UX is the actual attack surface, not the cryptography – UI spoofing proves that.
WazirX users still waiting for compensation while the exchange argues with Liminal about whose fault it was. 230M gone and the finger pointing continues
Priyanka G. the Liminal vs WazirX blame game is worse than the hack. both sides knew the multisig UI was the weak link and neither invested in fixing it
8 days of recon and liminal didnt notice abnormal API patterns. their monitoring was either broken or ignored
8 days of recon and Liminal monitoring did not catch it. either their alerts were misconfigured or nobody was looking. both are unacceptable for a custody provider handling hundreds of millions
front end manipulation is terrifying because your hardware wallet says the transaction looks fine. the display lies to you
exactly why you need to verify the raw transaction data independently. never trust what the signing interface shows you
CloudSEK found 8 days of recon and Liminal still missed it. their SOC either had zero alerting on API anomalies or was asleep