The hackers attacked for the $235 million WazirX crypto exchange breach had started preparing on-chain at least eight days in advance, says Mudit Gupta, the Chief Information Security Officer of Polygon Labs.
WazirX, one of India’s largest cryptocurrency exchanges, was hit by a multi sig wallet hack on Thursday, July 18. The attack, which resulted in hundreds of millions of dollars in losses, is believed to have been carried out by the North Korean hacking group Lazarus.
According to Gupta, the hackers began “practicing” the hack onchain more than a week before the attack. They upgraded the multi-sig wallet to a malicious version, which later allowed them to drain the funds, Gupta explained in a July 18 post on X.
Tarun Mangukiya, co-founder of payment platform Copperx, thinks the hackers may have tricked WazirX into upgrading its Safe Implementation Skeleton.
“Why did they upgrade it instead of just draining?” Gupta asked.
Draining funds takes time and multiple transactions. The hackers likely didn’t have all the necessary private keys and relied on signature phishing, which they couldn’t do numerous times without being caught.
In a follow-up post on X, WazirX called the attack a “force majeure event beyond our control.” They have already blocked a few deposits and contacted concerned wallets for recovery. The exchange announced a temporary withdrawal freeze shortly after the hack.
