Thread by @BoringSleuth

A 🧵showing @WazirXIndia's own misleading actions and security lapses which most likely led to their Customers loosing over $230M in assets 👇

🫡
1/18 🧵

On July 18th, 2024 @WazirXIndia's Multisig Account, which held over $230M in Customer Assets, was drained by what they claim to be an "unknown" hacker.

Below are the Top 33 assets drained from this account, which resided at address: 0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4.

Three days after the exploit, @wazirxindia offered 2 seperate Bounties in regards to this exploit. The first bounty of $10,000 was to Track and aid in Freezing of the assets. The second Bounty is for 10% of the ammount of funds recovered.

wazirx.com/blog/wazirx-bo…

What WazirX failed to do was offer any Bounty that aided in understanding who it was that was behind the Exploit of over $230M in their Customers assets. At this time, it is not understood why they wouldn't offer a bounty for this.

We decided to look into where WazirX went wrong.

To begin our investigation, we looked at WazirX's own preliminary report on this Cyber Incident, and compared it with what we is shown in the actual Contract of their Exploited Multisig. We Immediately found massive red flags.

Red Flag #1:

WazirX incorrectly states that a transaction on their Multi Signature account requires 3 WazirX signatories and a final approval from Liminal's signatory.

Of note, the WazirX multisig had 6 approved address' that could sign a transaction, 4 of which was required.

The original Multi Signature contract was setup on December 12th, 2022, requiring 3 Signatures, with 5 approved Signatures. In February, a 6th Signature was added, and the threshold for approving was moved to require 4 Signatures. You can see the changes from the original below:

The Red Flag here is that this Multisignature wallet always needed to have 3, and then later, 4 Signatures, though WazirX makes it seem like that wasn't the case. 🚩

This is where it gets really interesting.

Red Flag #2: Below shows that 4 of the Original 5 Multi Signatures were all originally funded and setup by the other remaining Multi Signature. This means that there is a significant likelihood that only 1 Person, had access/control over all 5 of the original signee's.

The purpose of a Multi-sig is to limit your exposure if 1 of your keys is comprimised. Then the exploiter can only sign 1 of the required signatures, and you can avoid an attack.

For instance, Wazir places blame on Liminal, who was granted their 6th and final signature.

But Liminal only controlled 1 signature, where WazirX controlled 5 of the 6, all of which was setup thru Binance, not Wazir. 🚩

In addition to this, even the Liminal address was originally setup and funded thru a Binance exchange, not a WazirX exchange. 🚩

The fact that while WazirX had a threshold of 4 signatures of the 6 eligible signee's is great, but completely ineffective and a major security flaw when 5 of the 6 Signatures seem to all be controlled by the same Keys, therefore 1 entity or person.

There a more Red Flags 👇

Before I show the last Red Flags, I want to point out that on July 6th, 12 days prior to this exploit of over $230M, I called out this exact Security flaw, which exists accross the Majority of Layer 2's, where user funds are held on Multi-Signature contracts like WazirX's.

You can find that thread here, showing @blast @0xMantle @Optimism and @Coinbase's own @base have this exact same risk. These contracts hold several BILLION dollars of User funds, all with the same security flaws. One can only wonder why.

https://x.com/BoringSleuth/status/1809660985508261984

The below post covers another 🚩showing that WazirX's main exchange address, setup in 2022, 3 years after WazirX was founded, actually began as a Binance address, that was already tied to fraud and theft, and continued to act as if it was still Binance.

https://x.com/BoringSleuth/status/1818827544709263801

And for the Last Red Flag, in the below Thread, I show how WazirX's Deployer only ever sent funds to Binance, SwipeX (a fraud connected protocol), and a Burn address.

https://x.com/BoringSleuth/status/1818989946541060607

In summary, WazirX was misleading, if not outright lying in their own diagnosis of the exploit, placing blame elsewhere. WazirX appears to have never became independent of Binance, and their shared Multisig account was exploitable because 1 person controlled 5 of the 6 signees.

I hope you found this Thread helpful, and I hope you make sure you remove your funds off any Blockchains & exchanges that are bypassing the important security measures outlined above.

@WazirXIndia and @binance need to make Customers whole, immediately, and own their mistakes

🫡