Liminal addresses role in WazirX hack, challenges exchange’s claims

Liminal has addressed the ongoing controversy surrounding WazirX’s submission of 240,000 wallet addresses to the Singapore court.

The 1,100-page submission has sparked debate within the cryptocurrency community. Now Liminal has released a statement to clarify their role and challenge what they describe as a disinformation campaign.

Liminal says most of the 240,000 wallets are hot wallets

According to Liminal’s analysis of the 240,000 wallet addresses shared by WazirX, the majority are hot wallets. However, only a handful are warm/cold wallets managed through Liminal’s infrastructure.

These select wallets held approximately $300 million in balance funds for several days and about $177 million for several months after the incident.

Liminal emphasized that their contractual relationship with WazirX was strictly limited to software subscription services for their self-custody infrastructure platform.

The service provided WazirX with cold/warm wallets, excluding one low-balance hot wallet. Importantly, Liminal stated that WazirX did not utilize several crucial Liminal infrastructure offerings.These include Liminal’s hot wallet services.

Despite WazirX’s public announcement on August 14, 2024, claiming to have terminated their contract with Liminal, the exchange continued using Liminal’s infrastructure to manage remaining user funds.

“However, far from this posturing, WazirX continued to use Liminal’s infrastructure to access and manage their remaining user funds,” Liminal stated.

Liminal added that even 75 days after the hack, WazirX held over $175 million in assets on Liminal’s platform. As per their statement, around $50 million in crypto still remains with Liminal.

Liminal also drew direct parallels between the WazirX incident and the recent Radiant Capital hack.

They noted identical attack vectors involving three signers using ledger devices, multi-sig smart contract wallets, signature mismatches, transaction rejection errors, and smart contract wallet upgrades to seize control.

The company highlighted the different responses between Radiant Capital, which provided a transparent post-mortem report. Liminal stated that WazirX, however, chose to blame Liminal through social media posts that were later retracted.

What happened with WazirX?

The crisis began on July 18, 2024, when WazirX reported a cyberattack on their multi-signature wallet managed by Liminal’s infrastructure.

The breach resulted in the theft of over $230 million, representing more than 40% of WazirX’s total holdings at the time.

The exchange immediately implemented emergency measures, including the suspension of all deposits, withdrawals, and trading activities. They also initiated a thorough security audit, contacted law enforcement agencies, and launched a bounty program for stolen asset recovery.

In late August 2024, WazirX sought protection under Singapore’s Insolvency Act, initially requesting a six-month moratorium. However, the court decided to grant a reduced four-month period.

The situation became more serious when reports emerged about post-hack fund movements. WazirX reportedly transferred approximately $73.63 million worth of user crypto assets to other exchanges. Out of this, $72.13 million went to Bybit and $1.5 million to KuCoin.

Making sense of WazirX’s wallet disclosure for users

Crypto exchange WazirX — which allegedly faced a cyberattack in July 2024 — has released over 240,000 wallet addresses as part of an affidavit they filed in the High Court of Singapore.

These many wallet addresses can be… pic.twitter.com/QfaEmuQXUZ

— Ashish Singhal (@ashish343) October 21, 2024

This movement of funds prompted CoinSwitch co-founder Ashish Singhal to take action. After identifying these transfers, CoinSwitch expressed serious concerns about the implications for affected users.

CoinSwitch also developed a specialized dashboard to help users move through thousands of addresses.

Liminal had earlier clarified that as a self-custody provider, they cannot transfer or initiate any transactions related to WazirX funds. They also mentioned that such capabilities reside solely with the WazirX team.

WazirX founder clarifies the fund movement

As the reports about the movement started surfacing, WazirX founder Nischal Shetty took to X to address the false claims.

Nischal stated that POR work is ongoing and that the team is trying to complete it as soon as possible to share it with everyone.

POR work is ongoing. Team is aiming to complete it asap so we can share it with everyone.

There have been false claims circulating that funds were moved to exchanges to trade!

Funds were moved to some exchanges because we are still in the process of onboarding a custodian. This…

— Nischal (Shardeum) ???? (@NischalShetty) October 22, 2024

He also pointed out that false claims are circulating that the funds were moved to exchanges to trade.

“Funds were moved to some exchanges because we are still in the process of onboarding a custodian,” Nischal added. He also stated that even custodians don’t support all tokens and that they have to use third party exchanges for token custody.

In a separate tweet, Nischal also mentioned that the current reports look like a coordinated campaign. The founder highlighted that it was them who disclosed the addresses and that they know how blockchain works and everything is traceable.

Nischal clarified that the POR would reveal all the claims that are circulating at the moment.