Wazirx Files For Debtor Protection As Hackers Continue To Launder Millions

On July 18, 2024, a massive hack hit WazirX, India’s largest cryptocurrency trading platform, leading to the theft of $235 million—about half of the company’s total assets. The exchange immediately froze all transactions preventing users from withdrawing any funds from their accounts. Recently, after WazirX allowed its users to withdraw their assets, a wallet address linked with a WazirX hacker has moved $6.5 million worth of stolen ether to Tornado Cash. 

Once on a trajectory to become India’s first billion-dollar crypto unicorn, WazirX’s rapid ascent has derailed dramatically. The platform, founded by Nischal Shetty, scaled quickly, aiming to democratize crypto trading in India. 

But the July security breach led to a significant loss of cryptocurrencies, totaling around $235 million and included $97 million in Shiba Inu, $52.6 million in Ethereum, and other currencies. In response to the breach, WazirX immediately froze all transactions, and this freeze lasted until August 26 when the company announced that its customers would be able to draw down only 33% of their available INR balances.

Users of the exchange quickly raised angry questions about what had happened to the rest of their balances at which time WazirX announced its 2nd phase of INR withdrawals on Sept. 3, 2024, through which users could withdraw up to the 66% limit of their available INR balances.

Source: Arkham Intelligence

On September 2nd, a WazirX hacker transferred $6.5 million worth of stolen Ether through Tornado Cash, a sanctioned crypto mixer, according to Arkham Intelligence, a blockchain analytics platform. The funds were moved in several batches with each batch worth 100 Ether.

This is the first time the WazirX hackers have been identified as using Tornado Cash to perform these transactions. The decentralized platform has become infamous for executing private and illegal transactions on Ethereum. It’s the same platform that the renowned North Korean Lazarus Group has utilized to transfer its stolen crypto. For this reason, some crypto analysts are suggesting Lazarus Group is responsible for the WarirX hack. If so, tracing the transaction records will be an uphill task for investigators.

As circumstances surrounding the hack evolve, Singapore’s Zettai Pte Ltd, the parent company of WazirX, has filed an application with the High Court of Singapore on 27 August 2024 for a moratorium under section 64 of the Insolvency, Restructuring, and Dissolution Act 2018 to facilitate its intention to restructure its liabilities under a scheme of arrangement.

WazirX has hired restructuring experts Kroll to help with its legal procedures. Kroll also joined the live call with the users of the exchange at the townhall meeting on Sept. 2, 2024 (Kroll is the same company that has been managing the BlockFi wind-up). 

According to a  Kroll spokesperson, “There are ongoing discussions through which we hope to generate additional money to be able to return to users. The second way would be if we are capable of recovering the stolen crypto and ongoing investigation in relation to that. Thirdly through the platform, if we are able to reach a restructuring arrangement with the creditors, we hope to have profits in the future which will be shared with the creditors.” 

But, it will not be an easy ride for the exchange users. This whole process is expected to take a minimum of six months, and it’s anticipated only 55-57% of the total funds in crypto terms will be returned to the users after the completion of the restructuring process.