The biggest Indian cryptocurrency exchange just suffered a million-dollar attack.
WazirX has experienced a wallet exploit, resulting in the unauthorized transfer of over $230 million worth of crypto assets.
An X post revealed that $234.9 million from the Indian exchange’s Safe Multisig wallet were moved to a new address, with each transaction funded by Tornado Cash, a decentralized protocol for private transactions.
The exploit targeted the exchange’s multisig wallet on the Ethereum network, likely due to a private key compromise, draining the funds. To execute the attack, the perpetrator upgraded the implementation of this Safe Wallet to a malicious contract, as explained by security firm Blocksec.
In a recent X post, WazirX acknowledged the incident, stating that it is still investigating the outflows and has paused all withdrawals.
Crypto sleuth ZachXBT announced on Telegram that the suspected primary attacker address still holds over $104 million to dump.
The compromised funds were moved to an address that has begun converting stolen assets, such as PEPE ( down by 1.23%), GALA (down by 7.11%), and USDT, into ether.
WazirX’s WRX token is trading 15.6% lower at just over 14 cents, according to Coingecko data. The rupee-denominated price has dropped more than 25% since the exchange confirmed the hack, with the attacker walking away with $230 million in customer funds, including $100 million in SHIB. The attacker also drained $52 million in ETH, $11 million in MATIC, and $6 million in PEPE.
Notably, the bitcoin-rupee (BTC/INR) pair has declined by 11% to 5.1 million rupees ($60,945), trading at a significant discount compared to rival exchange CoinDCX, where the cryptocurrency is priced at 5.7 million rupees. BTC’s global average dollar-denominated price traded 1% higher on the day at $61,800.
