Verify a decision

{"actor":"system:backfill","investigation_id":"d32c6324-cf7c-4195-8d4f-05c20913c10d","kind":"publish","page_slug":"wazirx","published_at":"2026-05-19T19:14:04.092Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"WazirX","sections":[{"content":"WazirX was founded in March 2018 by Nischal Shetty, Sameer Mhatre, and Siddharth Menon in Mumbai, India. The exchange grew to become India's largest domestic cryptocurrency trading platform, reporting approximately 7 million registered users by 2021. In November 2019, Binance publicly announced it had acquired WazirX; however, Binance subsequently denied completing any ownership transfer, a dispute that later escalated to formal litigation. Shetty has maintained that the sale was completed and released emails he alleged showed Binance pressuring him to deny the affiliation. Binance issued a public statement in September 2024 asserting it has 'not owned, controlled, or operated WazirX at any time, including before, during, or after the July 2024 attack.' WazirX had previously faced regulatory pressure: India's Enforcement Directorate (ED) issued show-cause notices in June 2021 and again in August 2022 alleging FEMA (Foreign Exchange Management Act) violations related to approximately Rs 2,790 crore (~$335 million) in alleged outward remittances to unknown wallets connected to an investigation into Chinese-linked illegal online betting applications. The exchange also faced criticism during India's 2018 RBI crypto banking ban, pivoting to a peer-to-peer trading model to survive the regulatory environment.","heading":"Background and History","severity":"medium","sources":[{"credibility":1,"name":"CNBC: Nischal Shetty built India's largest crypto trading exchange","type":"news_article","url":"https://www.cnbc.com/2021/07/07/wazirx-nischal-shetty-built-indias-largest-crypto-trading-exchange.html"},{"credibility":1,"name":"Business Standard: Enforcement Directorate issues notice to WazirX over FEMA breach","type":"news_article","url":"https://www.business-standard.com/article/markets/enforcement-directorate-issues-notice-to-wazirx-directors-over-fema-breach-121061200067_1.html"},{"credibility":2,"name":"Binance blames WazirX CEO Nischal Shetty for misleading users — BanklessTimes","type":"news_article","url":"https://www.banklesstimes.com/articles/2024/09/18/binance-blames-wazirx-ceo-nischal-shetty-for-misleading-users/"},{"credibility":2,"name":"WazirX founder Nischal Shetty says Binance ownership dispute now in litigation — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wazirx-binance-ownership-dispute-litigation/"}]},{"content":"On July 18, 2024, approximately $234.9 million in digital assets were drained from a WazirX multi-signature wallet managed in custody by Liminal Custody Solutions. The compromised wallet was a Gnosis Safe multisig configured with a 4-of-6 signature scheme: five keys held by WazirX personnel and one key controlled by Liminal Custody. Security researchers and forensic firms determined that the attacker deployed a malicious smart contract on the Ethereum network eight days before the attack (July 10, 2024), funding the operation via Tornado Cash. On the day of the attack, the exploiter submitted a transaction that appeared benign in the Liminal Custody web interface but contained a hidden malicious payload. The discrepancy between the displayed transaction data and the actual on-chain payload caused four signatories — three from WazirX and one from Liminal — to approve a transaction that replaced the Gnosis Safe multisig implementation with the attacker's pre-deployed malicious contract. Once the contract was swapped, the attacker held full, unilateral control of the wallet and bypassed both the multisig threshold requirement and any address whitelisting, draining all assets. The stolen funds comprised approximately 190 different tokens, with the largest positions being $97.26 million in SHIB tokens, $52.98 million in ETH, and $11.17 million in MATIC. WazirX and Liminal Custody publicly blamed each other for the breach. Mandiant's August 14, 2024 forensic report concluded the attack originated from Liminal's systems, a finding Liminal disputed; Liminal commissioned a separate review by Grant Thornton. WazirX terminated its custody relationship with Liminal in August 2024 and began migrating remaining assets to institutional custodians including BitGo.","heading":"The July 2024 Hack: Attack Mechanics","severity":"critical","sources":[{"credibility":2,"name":"2024 WazirX hack — Wikipedia","type":"other","url":"https://en.wikipedia.org/wiki/2024_WazirX_hack"},{"credibility":2,"name":"Explained: The WazirX Hack (July 2024) — Halborn Security","type":"research","url":"https://www.halborn.com/blog/post/explained-the-wazirx-hack-july-2024"},{"credibility":1,"name":"WazirX, Liminal Custody Blame Each Other as $230M Crypto Exploit Leaves Customers Stranded — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2024/07/19/wazirx-liminal-custody-blame-each-other-as-230m-crypto-exploit-leaves-customers-stranded"},{"credibility":1,"name":"WazirX Ends Custody Relationship With Liminal — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2024/08/14/wazirx-ends-custody-relationship-with-liminal-is-moving-funds-to-new-multisig-wallets"},{"credibility":2,"name":"Investigating the WazirX Hack and Flow of Funds — Merkle Science","type":"research","url":"https://www.merklescience.com/blog/investigating-the-wazirx-hack-and-flow-of-funds"},{"credibility":2,"name":"Another Lazarus Group Attack? Decoding WazirX Multisig Wallet's $235M Exploit — QuillAudits","type":"research","url":"https://quillaudits.medium.com/another-lazarus-group-attack-decoding-wazirx-multisig-wallets-235m-exploit-8a1218a88593"}]},{"content":"Multiple independent on-chain investigators, blockchain analytics firms, and three national governments have attributed the July 2024 WazirX hack to North Korea's Lazarus Group. On July 18, 2024 — the day of the hack — on-chain investigator ZachXBT published an analysis on X stating the attack had 'the potential markings of a Lazarus Group attack,' citing patterns in the pre-attack funding and attack execution consistent with prior Lazarus operations. Blockchain analytics firm Elliptic issued a statement confirming that 'on-chain analysis and other information reviewed by Elliptic indicates that this hack was perpetrated by hackers affiliated with North Korea.' ZachXBT subsequently submitted forensic evidence including a KYC-linked deposit address used by the exploiter, funded via six transactions of 0.1 ETH each from Tornado Cash — a pattern consistent with Lazarus Group operational security tradecraft. On January 14, 2025, the governments of the United States, Japan, and South Korea issued a formal joint statement through the US Department of State explicitly attributing the $235 million WazirX hack to North Korea's Lazarus Group. The statement placed the WazirX hack within a broader $659 million in cryptocurrency thefts attributed to the DPRK during 2024, which also included the $308 million DMM Bitcoin hack, the $50 million Upbit breach, and the $16.13 million Rain Management theft. The governments stated that DPRK cyber operations represent a significant threat to the integrity of the international financial system and that stolen funds support North Korea's weapons of mass destruction and ballistic missile programs.","heading":"Lazarus Group Attribution","severity":"critical","sources":[{"credibility":1,"name":"US Department of State: Joint Statement on Cryptocurrency Thefts by the DPRK — January 2025","type":"regulatory","url":"https://2021-2025.state.gov/office-of-the-spokesperson/releases/2025/01/joint-statement-on-cryptocurrency-thefts-by-the-democratic-peoples-republic-of-korea-and-public-private-collaboration/"},{"credibility":1,"name":"North Korean hackers likely behind $235 million WazirX exploit: Elliptic — The Block","type":"news_article","url":"https://www.theblock.co/post/306106/north-korea-wazirx"},{"credibility":2,"name":"Onchain analysts tie $235M Indian exchange exploit to North Korean hackers — Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/wazirx-235m-hack-north-korean-hackers"},{"credibility":2,"name":"North Korea's Lazarus Group behind $235M WazirX hack, confirms joint statement by US, South Korea, Japan — BusinessToday","type":"news_article","url":"https://www.businesstoday.in/technology/news/story/north-koreas-lazarus-group-behind-235-million-wazirx-hack-confirms-joint-statement-by-us-south-korea-japan-460804-2025-01-14"},{"credibility":2,"name":"Crypto Sleuth Suggests $230M WazirX Hack Linked to Lazarus Group — The Daily Hodl","type":"news_article","url":"https://dailyhodl.com/2024/07/18/crypto-sleuth-suggests-230000000-wazirx-crypto-hack-linked-to-north-koreas-lazarus-group/"}]},{"content":"The primary compromised WazirX wallet address is 0x27fD43BABfbe83a81d14665b1a6fB8030A60C9b4. The attacker's primary receiving address identified by on-chain analysts is 0x04b21735E93Fa3f8df70e2Da89e6922616891a88. Pre-attack, on July 10, 2024, the exploiter funded a preparation wallet via Tornado Cash in six transactions of 0.1 ETH each. Following the July 18 hack, stolen assets were distributed across multiple wallets and systematically converted to ETH via decentralized exchanges to simplify laundering. Beginning in early September 2024, the exploiter began routing stolen ETH through Tornado Cash in large tranches. On September 3, 2024, approximately $4 million in ETH was moved across 16 transactions to a Tornado Cash router. By September 9, 2024, an additional $11 million in ETH was routed to Tornado Cash. On-chain monitoring showed the exploiter transferred 20,004 ETH split across four wallets of 5,001 ETH each, with each wallet subsequently draining to Tornado Cash in 100 ETH batches. By approximately September 2024, all but roughly $6 million of the stolen funds had been transferred out of the initial exploit wallet. Funds were also alleged to have been sent to ChangeNOW and Binance, where they were reportedly blocked. ZachXBT has additionally connected Lazarus Group laundering of WazirX funds — along with Bybit hack proceeds — through small OTC brokers on the Tron network.","heading":"On-Chain Activity and Fund Laundering","severity":"critical","sources":[{"credibility":1,"name":"WazirX Hacker Starts to Move Stolen Ether Using Tornado Cash — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2024/09/03/wazirx-hacker-starts-to-move-stolen-ether-using-tornado-cash"},{"credibility":1,"name":"WazirX Hacker Moves $11M Stolen Ether to Tornado Cash — CoinDesk","type":"news_article","url":"https://www.coindesk.com/business/2024/09/09/wazirx-hacker-moves-11m-stolen-ether-to-tornado-cash"},{"credibility":2,"name":"WazirX exploiter moves $11.6M in ETH to Tornado Cash — crypto.news","type":"news_article","url":"https://crypto.news/wazirx-exploiter-moves-11-6m-in-eth-to-tornado-cash/"},{"credibility":2,"name":"Lazarus Group Laundered Billions in Crypto — And Tron Helped, Says ZachXBT — CCN","type":"news_article","url":"https://www.ccn.com/news/crypto/lazarus-group-small-otc-brokers-launder-bybit-wazirx-funds/"},{"credibility":2,"name":"Expert Analysis: How the $230M WazirX Hack Happened — Crystal Intelligence","type":"research","url":"https://crystalintelligence.com/investigations/expert-analysis-wazirx-hack/"}]},{"content":"Following the July 2024 hack, WazirX filed a First Information Report (FIR) with the Special Cell of the New Delhi Police and engaged India's cybercrime authorities. Indian law enforcement — including officers from the Financial Intelligence Unit (FIU), the Intelligence Bureau (IB), and CERT-IN — held meetings with WazirX founders to investigate how funds were transferred. Delhi Police subsequently arrested a West Bengal resident identified as SK Masud Alam, who allegedly created a fraudulent WazirX account under the alias Souvik Mondal and sold it on Telegram to a buyer allegedly linked to the hack. The Enforcement Directorate (ED) also conducted searches related to broader crypto fraud connected to WazirX accounts, seizing electronic devices and cash of approximately INR 25,60,000, following a Mutual Legal Assistance Request from the US Department of Justice alleging wire fraud and money laundering. Pre-dating the hack, the ED had issued multiple show-cause notices to WazirX between 2021 and 2022, alleging violations of FEMA related to Rs 2,790 crore (~$335 million) in transactions tied to a money-laundering investigation involving Chinese-linked illegal online betting applications. The exchange was alleged to have failed to collect required KYC documentation in violation of AML and CFT norms.","heading":"Law Enforcement and Regulatory Actions","severity":"high","sources":[{"credibility":1,"name":"WazirX Files Police Complaint After $230M Hack, Engages With India's Cyber Crimes Unit — CoinDesk","type":"news_article","url":"https://www.coindesk.com/policy/2024/07/19/wazirx-files-police-complaint-after-230m-hack-engages-with-indias-cyber-crimes-unit"},{"credibility":2,"name":"WazirX Hack Arrest: Delhi Police Arrests Suspect In $230 Million Crypto Heist — CoinGape","type":"news_article","url":"https://coingape.com/wazirx-hack-arrest-delhi-police-arrests-suspect-in-230-million-crypto-heist/"},{"credibility":2,"name":"Indian Law Enforcement Probes $235M WazirX Hack — MediaNama","type":"news_article","url":"https://www.medianama.com/2024/10/223-indian-government-investigates-235m-wazirx-hack-amid-binance-ownership-dispute/"},{"credibility":1,"name":"Enforcement Directorate issues notice to WazirX, directors over FEMA breach — Business Standard","type":"regulatory","url":"https://www.business-standard.com/article/markets/enforcement-directorate-issues-notice-to-wazirx-directors-over-fema-breach-121061200067_1.html"},{"credibility":1,"name":"Indian law enforcement agency alleges WazirX violated FEMA rules — The Block","type":"news_article","url":"https://www.theblock.co/post/108178/india-law-enforcement-agency-ed-crypto-exchange-wazirx-fema"},{"credibility":2,"name":"India's Largest Crypto Heist: Unpacking The $240M WazirX Cyberattack And Its Legal Implications — Mondaq","type":"news_article","url":"https://www.mondaq.com/india/fin-tech/1522558/indias-largest-crypto-heist-unpacking-the-$240m-wazirx-cyberattack-and-its-legal-implications"}]},{"content":"Following the hack, WazirX halted all withdrawals and initiated a Singapore court-supervised restructuring process. In an initial creditor vote conducted in April 2025, over 93% of voting creditors (131,659 creditors representing $184.99 million in value) approved a proposed Scheme of Arrangement, representing 93.1% by count and 94.6% by value. However, the Singapore High Court declined to approve this first plan on June 5, 2025, citing concerns about transparency — specifically WazirX's undisclosed incorporation of a new entity, Zensui Corporation, in Panama — and low overall creditor participation. The court extended WazirX's moratorium beyond June 6, 2025. Following court-ordered revisions, a second creditor vote was held in August 2025, producing 95.7% approval by number and 94.6% approval by value. The Singapore High Court sanctioned the revised restructuring scheme on October 13, 2025. Under the approved plan, users are expected to recover approximately 55% of their asset value: roughly 52% delivered in the cryptocurrencies WazirX still holds, with the remainder issued as Recovery Tokens — tradeable instruments representing claims on WazirX's future profits, revenues, and recovery efforts, with potential for periodic buybacks funded from platform profits. WazirX announced it would resume operations within 10 business days of the order becoming legally effective, with platform custody migrated to institutional providers. An Indian court separately halted a proposed XRP reallocation plan in October 2025, reflecting ongoing tensions between restructuring plans and user litigation in multiple jurisdictions.","heading":"Singapore Restructuring and User Fund Recovery","severity":"high","sources":[{"credibility":2,"name":"WazirX gets Singapore court approval to repay victims of $235M hack — Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/wazirx-singapore-court-approval-repay-235m-hack-victims"},{"credibility":1,"name":"WazirX Creditors Back Restructuring Plan — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2025/04/08/wazirx-creditors-back-restructuring-plan-to-payback-usd230m-hack-victims"},{"credibility":1,"name":"WazirX's Restructuring Plan Declined by Singapore Court — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2025/06/05/wazirxs-restructuring-plan-declined-by-singapore-court-hacked-indian-exchange-says"},{"credibility":2,"name":"WazirX restructuring plan gets 95.7% votes, awaits court approval — crypto.news","type":"news_article","url":"https://crypto.news/wazirx-restructuring-plan-gets-95-7-votes-awaits-court-approval/"},{"credibility":2,"name":"Singapore Court Approves WazirX Restructuring Plan — Crowdfund Insider","type":"news_article","url":"https://www.crowdfundinsider.com/2025/10/254555-crypto-exchange-wazirxs-restructuring-plan-approved-by-singapore-high-court/"},{"credibility":1,"name":"Indian Judge Halts WazirX's XRP Reallocation Plan — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2025/10/27/indian-judge-halts-wazirx-s-xrp-reallocation-plan-linked-to-2024-hack"},{"credibility":2,"name":"Singapore Court Extends WazirX Moratorium Beyond June 6 — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2025/06/24/singapore-court-extends-wazirx-moratorium-beyond-june-6/"}]},{"content":"In November 2019, Binance CEO Changpeng Zhao (CZ) publicly announced the acquisition of WazirX. However, Binance has subsequently denied that any ownership transfer was completed, creating an ongoing dispute with significant implications for accountability following the 2024 hack. Nischal Shetty has maintained that the sale was completed in late 2019 or early 2020 and released emails he claims show Binance pressuring him to publicly deny any affiliation between the two exchanges. Binance issued a public statement in September 2024 stating it has 'not owned, controlled, or operated WazirX at any time, including before, during, or after the July 2024 attack,' and accused Shetty of 'misleading WazirX customers and the market.' Shetty confirmed the dispute had escalated to formal litigation. The dispute is relevant to questions of fiduciary responsibility toward WazirX's approximately 6.6 million users whose funds were frozen following the hack, and to the question of whether Binance bears any liability for the security architecture of the exchange.","heading":"Binance Ownership Dispute","severity":"high","sources":[{"credibility":2,"name":"WazirX founder Nischal Shetty responds to ownership dispute with Binance — TheStreet","type":"news_article","url":"https://www.thestreet.com/crypto/business/wazirx-founder-nischal-shetty-responds-to-ownership-dispute-with-binance"},{"credibility":2,"name":"WazirX founder Nischal Shetty says Binance ownership dispute now in litigation — Cryptopolitan","type":"news_article","url":"https://www.cryptopolitan.com/wazirx-binance-ownership-dispute-litigation/"},{"credibility":2,"name":"Binance blames WazirX CEO Nischal Shetty for misleading users — BanklessTimes","type":"news_article","url":"https://www.banklesstimes.com/articles/2024/09/18/binance-blames-wazirx-ceo-nischal-shetty-for-misleading-users/"},{"credibility":2,"name":"Indian Law Enforcement Probes $235M WazirX Hack Amid Binance Ownership Dispute — MediaNama","type":"news_article","url":"https://www.medianama.com/2024/10/223-indian-government-investigates-235m-wazirx-hack-amid-binance-ownership-dispute/"}]},{"content":"The July 2024 hack froze assets belonging to approximately 6.6 million WazirX users, who lost access to their funds for over a year during the restructuring proceedings. Under the court-approved plan, users are expected to recover only approximately 55% of pre-hack asset values, with a portion issued as Recovery Tokens rather than direct asset distributions. The breach prompted user lawsuits filed in India. Approximately 420 individual investors organized across more than 15 WhatsApp and Telegram groups have sought collective legal action. Users were particularly aggrieved by an October 2025 proposal by WazirX to rebalance portfolios by acquiring XRP, which an Indian court halted pending further review. The restructuring's pro-rata loss-sharing mechanism, which distributes shortfalls across all users regardless of which assets they held, has been a point of significant user contention.","heading":"User Impact and Litigation","severity":"high","sources":[{"credibility":2,"name":"They lost everything in the WazirX heist. Now they pin their hopes on a lawsuit — YourStory","type":"news_article","url":"https://yourstory.com/2025/11/wazirx-users-seek-justice-in-a-lawsuit-high-court-xrp-rebalancing"},{"credibility":2,"name":"Fallout From WazirX Hack: What Happened After India's Biggest Crypto Heist — Entrepreneur India","type":"news_article","url":"https://www.entrepreneur.com/en-in/news-and-trends/fallout-from-wazirx-hack-what-happened-after-indias/486055"},{"credibility":1,"name":"Indian Judge Halts WazirX's XRP Reallocation Plan — CoinDesk","type":"news_article","url":"https://www.coindesk.com/markets/2025/10/27/indian-judge-halts-wazirx-s-xrp-reallocation-plan-linked-to-2024-hack"}]}],"sources_used":[],"summary":"WazirX is an Indian cryptocurrency exchange co-founded in 2018 by Nischal Shetty, Sameer Mhatre, and Siddharth Menon that suffered the largest crypto hack in Indian history on July 18, 2024, when approximately $234.9 million in user assets were stolen from a Gnosis Safe multisig wallet via a sophisticated supply-chain-style attack attributed by Elliptic, ZachXBT, and a joint US-Japan-South Korea government statement to North Korea's Lazarus Group. The hack triggered suspension of all withdrawals, a Singapore court-supervised restructuring process in which users are expected to recover approximately 55% of their assets, and ongoing regulatory and law enforcement scrutiny in India.","timeline":[{"date":"2018-03-01","event":"WazirX co-founded by Nischal Shetty, Sameer Mhatre, and Siddharth Menon in Mumbai, India.","source":"CNBC","source_url":"https://www.cnbc.com/2021/07/07/wazirx-nischal-shetty-built-indias-largest-crypto-trading-exchange.html"},{"date":"2019-11-01","event":"Binance announces acquisition of WazirX; Binance later denies the acquisition was completed, initiating a prolonged public dispute.","source":"Cryptopolitan","source_url":"https://www.cryptopolitan.com/wazirx-binance-ownership-dispute-litigation/"},{"date":"2021-06-11","event":"India's Enforcement Directorate issues show-cause notice to WazirX and directors Nischal Shetty and Sameer Mhatre alleging FEMA violations related to Rs 2,790 crore in transactions tied to an online betting fraud money-laundering probe.","source":"Business Standard","source_url":"https://www.business-standard.com/article/markets/enforcement-directorate-issues-notice-to-wazirx-directors-over-fema-breach-121061200067_1.html"},{"date":"2022-08-01","event":"India's Enforcement Directorate issues a second FEMA Show Cause Notice to WazirX regarding Rs 2,790 crore in alleged outward remittances.","source":"Business Standard","source_url":"https://www.business-standard.com/article/markets/ed-serves-fema-notice-to-cryptocurrency-exchange-wazirx-minister-122080301365_1.html"},{"date":"2024-07-10","event":"Attacker deploys malicious smart contract on Ethereum and funds preparation wallet via Tornado Cash (six 0.1 ETH transactions), eight days before the attack.","source":"Halborn Security / Crystal Intelligence","source_url":"https://www.halborn.com/blog/post/explained-the-wazirx-hack-july-2024"},{"date":"2024-07-18","event":"$234.9 million stolen from WazirX Gnosis Safe multisig wallet via malicious smart contract substitution. Liminal Custody interface manipulation caused four signatories (three WazirX, one Liminal) to approve the exploit transaction.","source":"Wikipedia / CoinDesk","source_url":"https://en.wikipedia.org/wiki/2024_WazirX_hack"},{"date":"2024-07-18","event":"ZachXBT publishes on-chain analysis on X identifying attack characteristics consistent with Lazarus Group operations.","source":"The Daily Hodl","source_url":"https://dailyhodl.com/2024/07/18/crypto-sleuth-suggests-230000000-wazirx-crypto-hack-linked-to-north-koreas-lazarus-group/"},{"date":"2024-07-18","event":"Elliptic issues statement attributing the WazirX hack to North Korea-affiliated hackers based on on-chain analysis.","source":"The Block","source_url":"https://www.theblock.co/post/306106/north-korea-wazirx"},{"date":"2024-07-19","event":"WazirX and Liminal Custody publicly blame each other for the breach. WazirX files FIR with New Delhi Police Special Cell and engages CERT-IN.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2024/07/19/wazirx-liminal-custody-blame-each-other-as-230m-crypto-exploit-leaves-customers-stranded"},{"date":"2024-08-14","event":"Mandiant publishes forensic report attributing the breach to Liminal Custody's systems. Liminal disputes findings and commissions Grant Thornton for an independent review.","source":"Wikipedia / CoinDesk","source_url":"https://en.wikipedia.org/wiki/2024_WazirX_hack"},{"date":"2024-08-14","event":"WazirX terminates custody relationship with Liminal and begins migrating remaining assets to new multi-sig wallets with institutional custodians.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2024/08/14/wazirx-ends-custody-relationship-with-liminal-is-moving-funds-to-new-multisig-wallets"},{"date":"2024-09-03","event":"WazirX exploiter begins laundering stolen ETH through Tornado Cash, initially moving approximately $4 million across 16 transactions.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2024/09/03/wazirx-hacker-starts-to-move-stolen-ether-using-tornado-cash"},{"date":"2024-09-09","event":"WazirX exploiter moves additional $11 million in stolen ETH to Tornado Cash. Exploiter transfers 20,004 ETH across four wallets, draining each in 100 ETH batches to Tornado Cash.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2024/09/09/wazirx-hacker-moves-11m-stolen-ether-to-tornado-cash"},{"date":"2024-09-18","event":"Binance publishes public statement denying any ownership, control, or operation of WazirX at any time, accusing Shetty of misleading users.","source":"BanklessTimes","source_url":"https://www.banklesstimes.com/articles/2024/09/18/binance-blames-wazirx-ceo-nischal-shetty-for-misleading-users/"},{"date":"2025-01-14","event":"US, Japan, and South Korea issue formal joint statement through the US Department of State explicitly attributing the $235M WazirX hack to North Korea's Lazarus Group, within a broader $659M in 2024 DPRK cryptocurrency thefts.","source":"US Department of State","source_url":"https://2021-2025.state.gov/office-of-the-spokesperson/releases/2025/01/joint-statement-on-cryptocurrency-thefts-by-the-democratic-peoples-republic-of-korea-and-public-private-collaboration/"},{"date":"2025-04-08","event":"93.1% of voting creditors (by count) and 94.6% by value approve WazirX's initial Scheme of Arrangement restructuring plan.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2025/04/08/wazirx-creditors-back-restructuring-plan-to-payback-usd230m-hack-victims"},{"date":"2025-06-05","event":"Singapore High Court declines to approve the initial restructuring plan, citing concerns over transparency including undisclosed incorporation of Zensui Corporation in Panama.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2025/06/05/wazirxs-restructuring-plan-declined-by-singapore-court-hacked-indian-exchange-says"},{"date":"2025-08-18","event":"Revised restructuring plan receives 95.7% creditor approval (by number) in second vote following court-ordered amendments.","source":"crypto.news","source_url":"https://crypto.news/wazirx-restructuring-plan-gets-95-7-votes-awaits-court-approval/"},{"date":"2025-10-13","event":"Singapore High Court sanctions the revised WazirX restructuring scheme. Users expected to recover approximately 55% of asset value via crypto distributions and Recovery Tokens.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/wazirx-singapore-court-approval-repay-235m-hack-victims"},{"date":"2025-10-24","event":"WazirX resumes exchange operations following Singapore court approval, with custody migrated to institutional providers including BitGo.","source":"Wikipedia","source_url":"https://en.wikipedia.org/wiki/2024_WazirX_hack"},{"date":"2025-10-27","event":"Indian court halts WazirX's proposed XRP reallocation plan, adding further legal complexity to user fund recovery.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2025/10/27/indian-judge-halts-wazirx-s-xrp-reallocation-plan-linked-to-2024-hack"}]},"v":1}