The WazirX Heist

Popcorn Storytime - This can get a little bit heavy to digest.

Wazirx - a Cryptocurrency Exchange, once a poster boy of Crypto in India - in July 2024 suffered a cyberattack losing nearly $235 Mn, i.e. 45% of its user funds.

(Approx INR 2000 Crores)

Imagine you invested INR 1000 in stock, and INR 450 worth of stock gets stolen.

Wazirx immediately paused all its operations including trading and withdrawal, and to avoid bankruptcy, went to Singapore High Court (where Parent Entity of Wazirx is registered).

- They filed for a Moratorium, which is a legal shield that stops anyone (like users or lenders) from suing the company while it tries to fix its finances.

(Thus, as an investor, your money is locked in.)

- Proposed a restructuring plan stating "Socialized Losses" : WazirX proposed a 55/45 split. Since 45% of funds were stolen, they suggested every user (even those whose specific tokens weren't stolen) take a ~45% haircut so everyone could get something back. This caused massive public outrage.

(Imagine, your stock is kept in a third party warehouse, and there's a theft in the same. Luckily your part of the stock is safe....but still you are asked to cover the losses.)

The Singapore court allowed WazirX to hold a vote with its creditors (the users) on the restructuring plan.

95.7% of voting creditors approved the plan, likely seeing it as the only way to recover any funds versus a total loss in liquidation.

(As an Investor who invested INR 1000, you are left with only INR 550).

In October 2025, Singapore High Court officially approved the scheme, and WazirX resumed its operations.

------

This is an interestingly strange story, which raises some critical questions:

1. How can the fate of Indian Investors be decided by a foreign court?

Nischal Shetty successfully used a complex corporate structure to shield the Indian entity (Zanmai Labs) from the full $235M liability.

The Corporate Structure:

Zanmai Labs (India): Handled INR deposits.

Zettai Pte Ltd (Singapore): Held the actual crypto tokens.

When the hack happened, it was Zettai (the token holder) that filed for protection in Singapore. Zanmai (the Indian entity) argued in Indian courts that it had no control over the crypto.

Indian users couldn't easily sue Zanmai in India for the crypto loss because the user agreement technically pointed to Zettai for crypto services. This jurisdictional arbitrage allowed them to bypass stricter Indian consumer protection laws in favor of Singapore's corporate restructuring laws.

2. If the tokens I held are not stolen, why should I cover the losses then?

This destroys the concept of "custody" in crypto. It implies that on centralized exchanges (CEXs), you don't own specific assets; 

you own a claim on the exchange's total pool. If the pool shrinks, everyone's claim shrinks, regardless of what specific asset they "held." 

This is legally closer to a bank run than a custodial vault theft.

3. Crypto = Secure; Crypto = Decentralised.

The whole advertisement of Cryptocurrencies revolve around security and decentralisation.

Then, how did this happen?

Crypto is "secure" because it is impossible to hack the mathematics (the lock). But it is very easy to hack the screen you are looking at (the eyes).

Wazirx used a "blind signing" security system, in which to proceed with a transaction wazirx managers need to approve 3 signs and 1 by a third party firm (Liminal).

Think of it as a digital bank vault requiring three keys to open.

Making it simple, The Hackers Controlled the Screen, the WazirX managers logged into their computer system to perform a routine maintenance task. The hackers had already infiltrated this computer system. The hackers changed the text on the computer screen to say: "Authorize System Upgrade."

The computer screen was lying. The actual command sent to the device was "Transfer $235 Million to Hacker's Wallet."

Both Wazirx and Liminal blamed each other for the breach, both got an independent audit done confirming no breach of security on their respective ends....which created a deadlock leaving the users in dismay.

4. Who's behind the scene of this attack?

Various intelligence firms along with the FBI, attributed the attack to the Lazarus Group, a cybercrime organization directly affiliated with the Democratic People's Republic of Korea (DPRK) - North Korea.

This attribution places the WazirX hack within a broader geopolitical context, where cryptocurrency theft serves as a critical funding mechanism for terror organisations.