How much was lost in the WazirX hack?

$235M Stolen, as publicly reported (July 18, 2024).

Who was behind the WazirX hack?

Publicly attributed to Lazarus Group. ChainHint does not attribute the attacker independently — it traces the funds from the address on the public record and reports where they went.

Case Studies/WazirX

WazirX Hack: $235M Stolen

Q: How was the WazirX hack carried out?

UI Spoofing. The Liminal custody platform's UI showed a benign transaction to WazirX co-signers, while the actual on-chain calldata contained a delegatecall that would upgrade the Safe multisig to an attacker-controlled contract. Three WazirX signers approved without detecting the mismatch.

July 18, 2024 · Ethereum / BNB Chain · Lazarus Group

stolen

$235M

suspected

Lazarus 🇰🇵

What happened

On July 18, 2024, India's largest crypto exchange WazirX lost $235M — roughly 45% of its total reserves — in a sophisticated multi-signature wallet attack. Attackers, suspected to be Lazarus Group, exploited a discrepancy between the transaction data displayed in the Liminal custody UI and the actual on-chain calldata. WazirX co-signers unknowingly approved a transaction that upgraded their Safe multisig contract to a malicious implementation, granting the attacker full control. Over $235M in 16+ token types — including SHIB, ETH, MATIC, and USDT — was drained and routed through Tornado Cash.

How the funds moved

Step 1

UI Spoofing

The Liminal custody platform's UI showed a benign transaction to WazirX co-signers, while the actual on-chain calldata contained a delegatecall that would upgrade the Safe multisig to an attacker-controlled contract. Three WazirX signers approved without detecting the mismatch.

Step 2

Wallet Takeover

Safe multisig contract upgraded to malicious implementation. With the upgrade confirmed by 3 of 4 required signers + Liminal's signer, the attacker gained unilateral control over the wallet and all held assets.

Step 3

Token Liquidation & Mixing

16+ token types drained, with SHIB accounting for ~$96M. Tokens swapped to ETH on DEXs to avoid individual token freezes, then funneled through Tornado Cash in batched transactions to obscure destination wallets.

Key findings

Largest Single Token Loss

SHIB — $96MShiba Inu tokens constituted ~41% of total stolen value. Dumped on DEXs immediately post-exploit.

ERC-20 Drain

Laundering Route

Tornado Cash (ETH)Stolen tokens swapped to ETH via Uniswap/1inch, then batched through Tornado Cash anonymity pools

Attribution

Lazarus Group (DPRK) — suspectedOn-chain patterns and attack methodology consistent with prior Lazarus operations. Not yet formally sanctioned.

Investigate your own incident

ChainHint traced the WazirX hack in minutes.
Use the same tool for your case.