Worked example · 2024-07
WazirX — Ethereum — 2024-07-18
Summary
WazirX, an Indian centralised cryptocurrency exchange, operated user-fund custody under a third-party arrangement with Liminal Custody. The custodial multisig wallet was structured with five WazirX signers and one Liminal Custody signer; transactions required three WazirX signatures plus the one Liminal signature (3-of-5 + 1) to be authorised.
On July 18, 2024, attackers obtained partial multisig access via the third-party custody surface (the T11.001 entry vector). Rather than draining the wallet directly via the standard authorisation flow, the attackers modified the smart contract controlling the multisig so that further extractions did not require additional WazirX signatures. Once the controlling contract was modified, the attackers drained approximately $234.9M in cryptocurrency assets — nearly half of WazirX's total holdings — without further involvement from any legitimate WazirX signer.
The WazirX case is the canonical OAK-T11.003 (In-Use Multisig Smart-Contract Manipulation) example because the failure mode is unambiguous from the public record (industry forensic providers reconstructed the contract-modification mechanism), the dollar loss is documented, and the structural lesson (contract-modification authority retained inside the multisig collapses the threshold predicate) is generalisable to other custodial-multisig architectures.
Timeline (UTC)
| When | Event | OAK ref |
|---|---|---|
| Pre-event | Attackers obtain partial multisig access via third-party custody surface (technical mechanism not fully publicly disclosed) | T11.001 entry vector |
| 2024-07-18 (T+0) | Attackers create a fake WazirX account, deposit tokens, begin purchasing GALA tokens | (operational setup) |
| 2024-07-18 | Hot wallet drained | T5-equivalent / T11 |
| 2024-07-18 | WazirX signatories access the multisig; attackers' code modifies the multisig's controlling smart contract | T11.003 extraction |
| 2024-07-18 | Full multisig wallet drained without further WazirX signatures (controlling contract now points at attacker authority) | T11.003 + T5-equivalent |
| 2024-07-18 (later) | WazirX suspends crypto trading; user balances reset to 13:00 IST (07:30 UTC), reversing post-hack trades | (response) |
| 2024-07-18 onward | Funds laundered via cross-chain swap protocols (T7.003 chain-hop pattern characteristic of OAK-G01 post-2022) | T7.003 + G01 attribution |
| 2024 onward | Industry forensic providers attribute to OAK-G01 Lazarus Group | G01 inferred-strong attribution (industry) |
| 2025-01-14 | U.S.–Japan–ROK trilateral Joint Statement on Cryptocurrency Thefts by the DPRK and Public-Private Collaboration names WazirX (~$235M) directly as a DPRK-attributed theft; attribution promoted to confirmed | G01 confirmed attribution (government) |
| 2025-10-24 | WazirX restarts operations after restructuring scheme legally effective; ~85% of stolen funds returned to users | (recovery via restructuring) |
What defenders observed
- Pre-event (third-party custody arrangement): WazirX's reliance on Liminal Custody for the +1 signer of the 3-of-5 + 1 multisig was a published operational practice. The third-party custody surface's compromise is the entry vector; the on-chain manifestation (contract modification) is the distinguishable feature relative to other Lazarus exchange-targeting cases.
- At-event (T11.003 contract modification): the multisig modification event itself is the unambiguous on-chain artefact. A custodial-multisig modification monitor (per the OAK-T11.003 detection signal) would have surfaced this within blocks — but the dollar-loss-prevented metric is bounded by how quickly that signal could be acted on (typically minutes-to-hours, not blocks).
- Post-event (laundering): the proceeds were laundered via cross-chain swap protocols characteristic of the post-2022 OAK-G01 laundering pattern; downstream T7.003 attribution is well-attested in industry tracking.
- Recovery layer: the restructuring-scheme recovery (85% returned to users via legal proceedings) is unusual at headline-incident scale and reflects the Indian regulatory and judicial process. Contributors writing future T11 cases should not assume an analogous recovery path.
What this example tells contributors writing future Technique pages
- T11.001 + T11.003 chains are the canonical multi-Technique pattern for custodial-multisig incidents. The entry vector (T11.001 third-party vendor compromise) is structurally distinct from the extraction mechanism (T11.003 contract modification). Worked examples should make both explicit and link them.
- Contract-modification authority inside a multisig is a standing risk surface. WazirX's design retained modification authority inside the multisig itself; once enough signers were compromised, the threshold predicate could be replaced. Post-WazirX custody architectures have widely moved modification authority to a separate, slower-pace governance contract with mandatory delay.
- Restructuring-scheme recovery is jurisdiction-specific. The ~85% recovery via the WazirX restructuring scheme reflects Indian legal process; contributors writing future T11 cases in other jurisdictions should not assume the same recovery pathway exists.
- Government attribution can lag industry attribution by 6–12 months. The WazirX case spent roughly six months at
inferred-strongstrength on industry-forensic-provider attribution alone before the U.S.–Japan–ROK trilateral statement (January 14, 2025) named WazirX directly and promoted the attribution toconfirmed. Contributors writing OAK-G01 examples should expect this lag pattern: industry forensic attribution is typically the first published surface, and government attribution (FBI / Treasury / multilateral statements) typically follows months later. The OAK attribution-strength language should be updated when the government-level statement lands, not held at industry-only strength after government attribution exists.
Public references
[wazirxwiki2024]— Wikipedia summary of the 2024 WazirX hack including the multisig-contract-modification mechanism.[crystalwazirx2024]— Crystal Intelligence forensic analysis of the attack vector.[chainalysis2024dprk]— broader OAK-G01 attribution context.[trilateraldprkstatement2025]— U.S.–Japan–ROK Joint Statement on Cryptocurrency Thefts by the Democratic People's Republic of Korea and Public-Private Collaboration, January 14, 2025; names WazirX ($235M) and Radiant Capital ($50M) as DPRK-attributed thefts (the U.S. and ROK attribute these specifically based on detailed industry analysis), alongside DMM Bitcoin / Upbit / Rain Management. The government-level event that promotes WazirX attribution frominferred-strongtoconfirmed.
Discussion
WazirX is OAK's modern canonical T11.003 example because the contract-modification mechanism is unambiguous, the dollar loss is documented, and the structural lesson — that modification authority should be removed from in-use multisigs and delegated to slower-pace governance — has been broadly absorbed by post-WazirX custody-vendor architectures. Contributors writing future T11.003 examples should expect the WazirX case to be the reference baseline for contract-modification-event detection methodology.
The WazirX case also illustrates an attribution-evolution pattern that recurs across the OAK-G01 record: an incident is initially inferred-strong on industry-forensic-provider analysis (Crystal Intelligence and others reconstructed the contract-modification mechanism within weeks of the July 2024 event); a multi-government statement follows months later (the U.S.–Japan–ROK trilateral statement of January 14, 2025 named WazirX directly); and the OAK attribution rating is then promoted from inferred-strong to confirmed. Contributors should treat industry-forensic and government-level attribution as separate evidentiary surfaces — the trilateral statement is the load-bearing document for the confirmed rating here, and contributors writing future OAK-G01 cases should track for the equivalent multi-government-statement event when one lands.