One of India’s top cryptocurrency exchanges, WazirX, is in the middle of a controversy after a massive security breach caused a loss of around $230 million, which is around 45% of its user assets. The breach, which occurred on July 18, 2024, not only raised questions about the platform’s security protocols but also about the proposed recovery strategy, which has caught massive criticism from the crypto community and industry experts.
The Breach: What Happened?
On July 18, 2024, WazirX was targeted by what is believed to be a North Korean hacker group. The attackers were able to breach one of the supposed-to-be multi-signature wallets of the exchange, a layer of security that requires more than one signature before a transaction is executed. Yet, the hackers were able to withdraw around $230 million from this multi-sig wallet and affect almost 50% of user-held assets.
Essentially, the plan says that all users on the platform would share the financial impact of the loss. The exchange has said this is part of the effort to maintain the stability of the platform and fairness to all users.
WazirX’s Response: The Socialised Loss Strategy
In the wake of the hack, WazirX announced a controversial recovery plan dubbed the “socialized loss strategy.” This plan essentially proposes spreading the financial impact of the loss across all users of the platform. According to the exchange, this approach is aimed at preserving the stability of the platform and ensuring fairness among its user base​.
Under the socialized loss strategy, users are presented with two options:
- Option A: Users can trade and hold their crypto assets but cannot withdraw them. This option prioritizes recovery efforts, meaning users choosing this path will be first in line for any future recovery distributions.
- Option B: This option allows users to trade and withdraw their assets but places them at a lower priority for recovery. This means that while users can access their funds, they may receive a smaller share of any recovered assets​.
Additionally, 55% of the remaining user assets will be made available for trading or withdrawals, while the remaining 45% will be converted into stablecoins, such as USDT, and locked. This measure, according to WazirX, is necessary to prevent further destabilization of the platform and to allow time for the potential recovery of the stolen funds.
Community Reaction and Criticism
However, the proposed recovery plan is criticized severely by users and industry pundits for actually leaving many users in a very frustrated state, feeling betrayed that they would bear the burden of the losses. Critics argue that WazirX should take the costs of the breach through its reserves or by some form of external funding instead of dividing the loss among the users.
Deepak Shenoy, CEO of Capital Mind, shared in a tweet, “The exchange should absorb the losses first before asking customers to share the burden.” He and others think that such a recovery plan would favor the platform itself but not the users—a move that could be counterproductive, as trust in WazirX might start to erode, possibly even leading to reputational damage.
Another major bone of contention has been the lack of insurance on customer funds. During a community call, Nischal Shetty said they didn’t have any insurance that could save the loss at that big scale. This realization has caused even more dissatisfaction among the users, who are now questioning the security and reliability of holding their assets on this platform.
Efforts to Recover the Stolen Funds
And yet, WazirX has not been sleeping on its laurels. In an effort, at least towards trying to get back the stolen funds, the exchange launched a bounty program that may offer up to $10,000 in Tether (USDT) for actionable intelligence, which may lead to freezing or recovery of the stolen assets. The initiative is likely to engage the wider crypto community in tracking down hackers and recovering funds.
The exchange also said it was working closely with blockchain forensics experts and had hired an external team of forensic experts to conduct a deep, involved audit into the matter. These experts are working in tandem with WazirX to trace the movement of the stolen funds, much of which has already been traced to new cryptocurrency addresses. Most of these funds have been converted to Ethereum and possibly also laundered through services like Tornado Cash, adding further layers of complications for the recovery process.
The Path Forward: Poll and Community Involvement
In an effort to involve the community in the recovery process, WazirX has initiated a poll among its users to vote on the proposed recovery options. This poll, while not legally binding, is intended to gauge user sentiment and inform the final decision-making process. Users have until August 3, 2024, to participate in the poll, and the results, along with ongoing investigations and the platform’s liquidity status, will be considered in the final decision​.
Nischal Shetty has emphasized the importance of community support during this challenging time. He has stated that the survival and future growth of WazirX depend heavily on the collective support of its users. He has also outlined potential future initiatives, such as using any future profits to compensate further affected users and exploring new business opportunities to bolster the exchange’s financial position​.
How PureWL Can Help?
In the wake of this security breach, PureWL, a provider of white-label VPN solutions, could play a crucial role in improving cybersecurity measures. PureWL offers a comprehensive VPN solution that includes advanced features such as military-grade encryption, split tunneling, and an internet kill switch, which are vital for protecting sensitive information and ensuring secure transactions. By integrating PureWL’s solutions, exchanges could bolster their defenses against future cyberattacks, safeguard user data, and restore confidence among their user base​.
PureWL can provide exchanges with the tools to secure its internal communications and transactions, mitigating the risk of similar breaches. The use of VPNs is critical for encrypting data and preventing unauthorized access, particularly in the financial sector, where data sensitivity is paramount.
Conclusion
The WazirX security breach has highlighted significant vulnerabilities within the cryptocurrency exchange landscape. As the platform navigates this crisis, the focus will be on its ability to recover the stolen funds, implement robust security measures, and regain user trust. The involvement of advanced security solutions like those offered by PureWL could be a pivotal step in ensuring the long-term safety and stability of the exchange. The coming weeks will be critical for WazirX as it seeks to stabilize its operations and restore confidence in its platform.