WazirX Suffers $235 Million Hack: Security and Response

TL;DR: WazirX, India’s largest crypto exchange, lost $235M in a wallet compromise. Not exploited through the exchange system itself — the private keys to their cold storage were somehow stolen. This is a custody failure, not a smart contract vulnerability.

July 2024. WazirX announced that their multi-signature wallet holding user deposits was drained. $235M+ gone.

What Actually Happened

WazirX runs an exchange. Customer deposits go into a multi-signature wallet (supposedly requiring multiple keys to authorize transactions).

An attacker gained control of the wallet and transferred everything out. The technical details remain unclear, but it appears the multi-sig was either:

• Compromised (keys were stolen)
• Never properly implemented (single key control, not multi-sig)
• Had a governance backdoor for fast withdrawals

The result: $235M of customer crypto disappeared.

This Is a Custody Problem, Not a Security Exploit

This wasn’t an exploit of smart contract logic. The attacker didn’t find a reentrancy bug or flash loan attack.

This was wallet security failure:

• Private key compromise (how?)
• Insufficient key management (keys stored insecurely?)
• Inadequate multi-sig implementation

This is why custody expertise matters. Exchanges need:

• Hardware security modules (HSMs) for key storage
• True multi-signature (not fake multi-sig with backdoors)
• Geographic distribution of keys across trusted parties
• Regular key rotation
• Operational security that would make a bank jealous

The User Impact

$235M of customer deposits. These are real people’s savings.

India doesn’t have crypto-specific insurance or regulations protecting customer deposits like US banks have FDIC.

So customers get… nothing. Except maybe a lawsuit against WazirX that takes years and recovers cents on the dollar.

What This Teaches Auditors and Builders

For protocol developers: Your smart contracts can be perfectly secure. But if your wallet is hacked, it doesn’t matter. Custody is not a technical problem alone — it’s operational.

For auditors: You can audit the exchange’s code. But you can’t audit their private key management. That requires visiting their operations, inspecting their HSMs, verifying their security procedures. Many audits don’t cover this.

For users: Even if an exchange’s contracts are flawless, your crypto is only as safe as their key management. No amount of code review fixes bad operational security.

Why This Keeps Happening

Custody is hard. It’s boring. There’s no “innovation” in HSMs or key management.

But there’s a lot of money in cutting corners. Maybe one key instead of three. Maybe keys in hot wallets instead of cold storage. Maybe a “backdoor” for emergencies.

Until someone loses $235M. Then everyone scrambles to fix what should have been correct from day one.

The Real Lesson

This is why “not your keys, not your coins” exists.

If you hold significant crypto, use a hardware wallet. Ledger, Trezor, anything with keys you control. Don’t trust exchanges to hold your wealth.

Exchanges are useful for trading. They’re terrible for storage. They’re single points of failure.

The Bottom Line

WazirX’s hack was preventable. All custody hacks are. They happen because someone prioritized speed/cost over security.

For the industry to mature, custody needs to be treated like it is in traditional banking: paranoid, redundant, audited relentlessly.

Until then, expect more $200M losses.

Stay safe out there. And seriously, use a hardware wallet.

Learn more about DeFi security and self-custody at blockchainwhitehackers.com