The WazirX Hack Explained: How $230M Left a Multisig

Video transcript

On July 18, 2024, over 230 million dollars left a WazirX multisig. WazirX says its signers approved something different from what the interface showed.

The Safe multisig ran on Liminal's infrastructure, with six signers, three WazirX approvals before Liminal's final one, Ledger hardware wallets, and a destination whitelist.

WazirX suspects a replaced payload handed wallet control to an attacker. A whitelist limits where funds go, not who controls the wallet.

Both firms describe a mismatch between what was shown and signed. WazirX points to Liminal's interface, Liminal to compromised WazirX devices. We take no side.

WazirX's incident log cites a joint statement by the United States, Japan and South Korea, linking North Korea to 659 million dollars in thefts, including 235 million tied to WazirX.

WazirX then restructured in Singapore. After a moratorium, an initial rejection and a revote backed by 95.7 percent of voting creditors, the scheme was sanctioned. Operations resumed on October 24, 2025.

Hardware wallets protected the keys, not the decision, and the same gap between screen and signature hit Bybit's signers.

SEAL's guide trusts no single screen. Recompute the transaction hash, match the entire hash on the device, decode the calldata, treat any delegate call as an alarm, and simulate.

Read the full breakdown, or talk to Guardian: its Managed Security team reviews every multisig transaction before it is signed.

WazirX, an Indian crypto exchange, lost over $230 million from one multisig wallet on July 18, 2024, by its own count.

The wallet had hardware wallet signers and a destination whitelist, and ran on Liminal's infrastructure. The two firms still give different accounts of where the attack began.

WazirX restructured through a Singapore court and resumed operations on October 24, 2025. Here is the record, and the signing controls it points to.

What Happened

The target was a Safe multisig. WazirX says it had run the wallet on Liminal's custody and wallet infrastructure since February 2023.

WazirX's preliminary report, published the same day, put the loss above $230 million. It said: "We suspect the payload was replaced to transfer wallet control to an attacker."

Rekt traced the attacker's preparation to at least eight days earlier, with funding from Tornado Cash and test transactions.

WazirX's incident log records a pause on deposits and withdrawals for all users from July 19, "to prevent further loss."

The Multisig Setup

WazirX described the wallet's controls in its preliminary report:

• Six signers: five from WazirX and one from Liminal.
• Three WazirX approvals, then a final approval from Liminal's signer.
• Ledger hardware wallets for the three WazirX signers who approved.
• A whitelist of destination addresses, set up through Liminal's interface.

Liminal frames its role differently. It says the product is self-custody wallet infrastructure and that "Liminal can never initiate a transaction," Inc42 reported.

CryptoSlate, summarizing Liminal's post-mortem, reported that the wallet "was deployed and imported into Liminal's system at WazirX's request."

A whitelist limits where transfers go. A payload that changes who controls the wallet is a different kind of transaction, and that is what WazirX suspects was signed.

Two Accounts of the Mismatch

Both firms describe a mismatch between what was shown and what was signed. They disagree on where it arose.

On August 14, 2024, WazirX began moving the remaining assets it held with Liminal to new multisig wallets.

We take no side on the dispute. Both accounts point to the same place: what a signer sees before approving.

Who Was Behind It

WazirX's incident log cites a joint statement on North Korean crypto theft by the US, Japan and South Korea, dated January 14, 2025.

Per the log, the statement links North Korea to $659 million in thefts, including $235 million tied to WazirX. The log makes no attribution of its own.

The Restructuring

WazirX did not simply reopen. It went through a scheme of arrangement in Singapore, proposed by Zettai Pte Ltd. Its incident log records the steps:

In February 2025, WazirX said about 85% of scheme creditors' balances would be distributed within 10 business days of the scheme taking effect.

The platform resumed operations on October 24, 2025, WazirX says.

Control Lessons

WazirX's account makes one point plain: hardware wallets protected the keys, not the decision.

The same gap between screen and signature hit Bybit's signers. See the Bybit hack explained.

SEAL's Safe verification guide sets a routine that does not trust any single screen.

1. Recompute the Safe transaction hash with safe_hashes.sh or OpenZeppelin Safe Utils.
2. Match the entire hash on the hardware wallet screen, not just the ends.
3. Decode the calldata and confirm the function, target and parameters.
4. Treat DELEGATECALL as an alarm unless the target is a known, audited module.
5. Simulate, and check that the decoded calldata agrees with the simulated effect.

Two more SEAL rules target the device layer.

• "Multi-sig operations must be performed on devices dedicated only to these transactions and verification tools."
• "Signers should not all use identical tools," so one bad tool cannot fool every signer.

Where a device shows only a hash, read what blind signing is. The full routine is in how to verify a Safe transaction before signing.

How Guardian Helps

Guardian's Managed Security maps every path to your funds: the contracts that hold them, the roles that can move them, and the keys and signers behind each.

Its security operations team reviews every multisig transaction before it is signed, and every deployment and configuration change as it lands.

For a one-time review, Guardian's OpSec Audit examines how transactions are proposed, checked and signed, and what a signer actually sees before approving.

Frequently Asked Questions

How much was stolen in the WazirX hack?

WazirX put the loss at over $230 million. Rekt reported $235 million, and WazirX's incident log cites a US, Japan and South Korea statement tying $235 million to WazirX.

Who hacked WazirX?

WazirX's incident log cites a joint statement by the US, Japan and South Korea from January 14, 2025. Per the log, the statement links North Korea to $659 million in crypto thefts, including $235 million tied to WazirX.

Was Liminal responsible for the WazirX hack?

That is disputed. WazirX says Liminal's interface showed data that differed from the transaction signed. Liminal says a Grant Thornton review found no evidence the attack came from its web application, and pointed to compromised WazirX devices.

Did WazirX users get their money back?

WazirX restructured through a Singapore scheme, sanctioned on October 13, 2025. It had said about 85% of scheme creditors' balances would be paid within 10 business days of the scheme taking effect. It resumed operations on October 24, 2025.

Sources

• WazirX: Preliminary Report, Cyber Attack on WazirX Multisig Wallet (July 18, 2024)
• WazirX: WazirX Cyber Attack, Day-wise Report (July 28, 2024, updated October 24, 2025)
• WazirX: What's New on WazirX, October 2026 Product Updates (November 5, 2026)
• Rekt: WazirX, Rekt (July 18, 2024)
• Cointelegraph: WazirX breach post-mortem, Dismantling the $230M attack (July 19, 2024)
• CryptoSlate: Liminal says infrastructure was not responsible for WazirX hack, blames compromised devices (July 19, 2024)
• Inc42: WazirX Hack, Liminal's Platform Not Responsible, Confirms Third-Party Forensic Report (September 9, 2024)
• Cointelegraph: Liminal challenges WazirX accusations after $235M security breach (October 22, 2024)
• SEAL Frameworks: Safe Multisig, Step-by-Step Verification (accessed November 6, 2026)
• SEAL Frameworks: Multisig Personal Security (OpSec) (accessed November 6, 2026)
• Guardian: Managed Security
• Guardian: OpSec Audit