OAK — OnChain Attack Knowledge

Worked example · 2024-07

WazirX — Ethereum — 2024-07-18

Loss
~$234.9M, representing approximately half of WazirX's total holdings at the time (per most-recent proof-of-reserve report).
Attribution
confirmed — see OAK-Gnn line below for attribution detail.
Recovery
WazirX entered restructuring; users received approximately 85% of stolen funds back via the restructuring scheme by October 24, 2025.
OAK Techniques observed
OAK-T11.001 (Third-Party Signing / Custody Vendor Compromise) — entry vector via Liminal Custody arrangement; OAK-T11.003 (In-Use Multisig Smart-Contract Manipulation) — extraction mechanism; downstream OAK-T7.003 (Cross-Chain Bridge Laundering) and OAK-T8.001 (Common-Funder Cluster Reuse).
OAK-Gnn
OAK-G01 Lazarus Group / DPRK-attributed. Attribution: confirmed as of January 14, 2025 — the U.S.–Japan–ROK Joint Statement on Cryptocurrency Thefts by the Democratic People's Republic of Korea and Public-Private Collaboration ([trilateraldprkstatement2025]) attributes the ~$235M WazirX theft directly to DPRK actors. Industry forensic providers (Crystal Intelligence, Chainalysis, Elliptic) had previously published consistent OAK-G01 attributions; the trilateral statement is the public-record event that promotes the case from inferred-strong to confirmed under OAK convention.
Key teaching point
WazirX is OAK's modern canonical T11.003 example because the contract-modification mechanism is unambiguous, the dollar loss is documented, and the structural lesson — that modification authority should be removed from in-use multisigs and delegated to slower-pace governance — has been broadly absorbed by post-WazirX custody-vendor architectures. Contributors writing future T11.003 examples should expect the WazirX case to be the reference baseline for contract-modification-event detection methodology.

Summary

WazirX, an Indian centralised cryptocurrency exchange, operated user-fund custody under a third-party arrangement with Liminal Custody. The custodial multisig wallet was structured with five WazirX signers and one Liminal Custody signer; transactions required three WazirX signatures plus the one Liminal signature (3-of-5 + 1) to be authorised.

On July 18, 2024, attackers obtained partial multisig access via the third-party custody surface (the T11.001 entry vector). Rather than draining the wallet directly via the standard authorisation flow, the attackers modified the smart contract controlling the multisig so that further extractions did not require additional WazirX signatures. Once the controlling contract was modified, the attackers drained approximately $234.9M in cryptocurrency assets — nearly half of WazirX's total holdings — without further involvement from any legitimate WazirX signer.

The WazirX case is the canonical OAK-T11.003 (In-Use Multisig Smart-Contract Manipulation) example because the failure mode is unambiguous from the public record (industry forensic providers reconstructed the contract-modification mechanism), the dollar loss is documented, and the structural lesson (contract-modification authority retained inside the multisig collapses the threshold predicate) is generalisable to other custodial-multisig architectures.

Timeline (UTC)

When Event OAK ref
Pre-event Attackers obtain partial multisig access via third-party custody surface (technical mechanism not fully publicly disclosed) T11.001 entry vector
2024-07-18 (T+0) Attackers create a fake WazirX account, deposit tokens, begin purchasing GALA tokens (operational setup)
2024-07-18 Hot wallet drained T5-equivalent / T11
2024-07-18 WazirX signatories access the multisig; attackers' code modifies the multisig's controlling smart contract T11.003 extraction
2024-07-18 Full multisig wallet drained without further WazirX signatures (controlling contract now points at attacker authority) T11.003 + T5-equivalent
2024-07-18 (later) WazirX suspends crypto trading; user balances reset to 13:00 IST (07:30 UTC), reversing post-hack trades (response)
2024-07-18 onward Funds laundered via cross-chain swap protocols (T7.003 chain-hop pattern characteristic of OAK-G01 post-2022) T7.003 + G01 attribution
2024 onward Industry forensic providers attribute to OAK-G01 Lazarus Group G01 inferred-strong attribution (industry)
2025-01-14 U.S.–Japan–ROK trilateral Joint Statement on Cryptocurrency Thefts by the DPRK and Public-Private Collaboration names WazirX (~$235M) directly as a DPRK-attributed theft; attribution promoted to confirmed G01 confirmed attribution (government)
2025-10-24 WazirX restarts operations after restructuring scheme legally effective; ~85% of stolen funds returned to users (recovery via restructuring)

What defenders observed

  • Pre-event (third-party custody arrangement): WazirX's reliance on Liminal Custody for the +1 signer of the 3-of-5 + 1 multisig was a published operational practice. The third-party custody surface's compromise is the entry vector; the on-chain manifestation (contract modification) is the distinguishable feature relative to other Lazarus exchange-targeting cases.
  • At-event (T11.003 contract modification): the multisig modification event itself is the unambiguous on-chain artefact. A custodial-multisig modification monitor (per the OAK-T11.003 detection signal) would have surfaced this within blocks — but the dollar-loss-prevented metric is bounded by how quickly that signal could be acted on (typically minutes-to-hours, not blocks).
  • Post-event (laundering): the proceeds were laundered via cross-chain swap protocols characteristic of the post-2022 OAK-G01 laundering pattern; downstream T7.003 attribution is well-attested in industry tracking.
  • Recovery layer: the restructuring-scheme recovery (85% returned to users via legal proceedings) is unusual at headline-incident scale and reflects the Indian regulatory and judicial process. Contributors writing future T11 cases should not assume an analogous recovery path.

What this example tells contributors writing future Technique pages

  • T11.001 + T11.003 chains are the canonical multi-Technique pattern for custodial-multisig incidents. The entry vector (T11.001 third-party vendor compromise) is structurally distinct from the extraction mechanism (T11.003 contract modification). Worked examples should make both explicit and link them.
  • Contract-modification authority inside a multisig is a standing risk surface. WazirX's design retained modification authority inside the multisig itself; once enough signers were compromised, the threshold predicate could be replaced. Post-WazirX custody architectures have widely moved modification authority to a separate, slower-pace governance contract with mandatory delay.
  • Restructuring-scheme recovery is jurisdiction-specific. The ~85% recovery via the WazirX restructuring scheme reflects Indian legal process; contributors writing future T11 cases in other jurisdictions should not assume the same recovery pathway exists.
  • Government attribution can lag industry attribution by 6–12 months. The WazirX case spent roughly six months at inferred-strong strength on industry-forensic-provider attribution alone before the U.S.–Japan–ROK trilateral statement (January 14, 2025) named WazirX directly and promoted the attribution to confirmed. Contributors writing OAK-G01 examples should expect this lag pattern: industry forensic attribution is typically the first published surface, and government attribution (FBI / Treasury / multilateral statements) typically follows months later. The OAK attribution-strength language should be updated when the government-level statement lands, not held at industry-only strength after government attribution exists.

Public references

  • [wazirxwiki2024] — Wikipedia summary of the 2024 WazirX hack including the multisig-contract-modification mechanism.
  • [crystalwazirx2024] — Crystal Intelligence forensic analysis of the attack vector.
  • [chainalysis2024dprk] — broader OAK-G01 attribution context.
  • [trilateraldprkstatement2025] — U.S.–Japan–ROK Joint Statement on Cryptocurrency Thefts by the Democratic People's Republic of Korea and Public-Private Collaboration, January 14, 2025; names WazirX ($235M) and Radiant Capital ($50M) as DPRK-attributed thefts (the U.S. and ROK attribute these specifically based on detailed industry analysis), alongside DMM Bitcoin / Upbit / Rain Management. The government-level event that promotes WazirX attribution from inferred-strong to confirmed.

Discussion

WazirX is OAK's modern canonical T11.003 example because the contract-modification mechanism is unambiguous, the dollar loss is documented, and the structural lesson — that modification authority should be removed from in-use multisigs and delegated to slower-pace governance — has been broadly absorbed by post-WazirX custody-vendor architectures. Contributors writing future T11.003 examples should expect the WazirX case to be the reference baseline for contract-modification-event detection methodology.

The WazirX case also illustrates an attribution-evolution pattern that recurs across the OAK-G01 record: an incident is initially inferred-strong on industry-forensic-provider analysis (Crystal Intelligence and others reconstructed the contract-modification mechanism within weeks of the July 2024 event); a multi-government statement follows months later (the U.S.–Japan–ROK trilateral statement of January 14, 2025 named WazirX directly); and the OAK attribution rating is then promoted from inferred-strong to confirmed. Contributors should treat industry-forensic and government-level attribution as separate evidentiary surfaces — the trilateral statement is the load-bearing document for the confirmed rating here, and contributors writing future OAK-G01 cases should track for the equivalent multi-government-statement event when one lands.

Techniques demonstrated (4)