WazirX Offers $23 Million to Hacker to Return Stolen Funds, Users Remain Concerned

The chaos in India's crypto ecosystem following one of WazirX's wallet breach is nowhere near an end for now. Over the weekend, the Indian crypto exchange hatched a bounty programme worth $23 million, hoping to recover the stolen funds worth over $230 million (roughly Rs. 1,924 crore) either from third parties, or from the hacker behind the breach. The exchange is offering rewards up to $10,000 (roughly Rs. 8.3 lakh) in USDT to those who could lead to the identification and freezing of the stolen funds. The exchange has, furthermore, decided to offer $23 million (roughly Rs. 192 crore) -- 10 percent of the stolen amount as White Hat Bounty to the hacker in exchange for the remaining funds.

In conversation with Gadgets360, WazirX user Sana Afreen said while this bounty brings hope for relief for the community, the scope of actually being able to trace the funds needs to speed up. Afreen is the Director of Partnerships at Rizzle, an AI-backed video creation platform.

“I have invested around Rs. 25 lakhs in crypto through WazirX. Now that the crypto market is at a bull run, my investment is more than the original investment amount. With withdrawals still paused at WazirX, my profits are stuck. This is why, the speed to trace needs to be faster. As a user, WazirX not being sure about when to restart withdrawals is very concerning,” Afreen said.

She also notes that the WazirX community could get some clarity about calculating their investment situation if the exchange could provide some timeline details around the restart of withdrawals.

As per WazirX's official blog, this bounty programme is valid for three months.

“All submissions must include detailed information, including addresses, transactions, and methodologies used for tracking and recovery. Participants must provide a proof of concept demonstrating how the funds can be tracked. WazirX will verify the information before disbursing the reward,” the blog read, disclosing that all submissions will be reviewed within 72 hours of being received.

Commenting on the situation, Jagdish Pandya, the founder and CEO of blockchain-centric investment firm Block On, highlighted that these are the types of situations where India requires a dedicated committee from the government to oversee damage control. Referring to previous hacks on centralised exchanges like Mt. Gox, Coincheck, and FTX – Padya said, the user communities of hacked platforms, have a history of either having to accept the losses or to enter an unlimited wait hoping for reimbursements.

The lack of regulatory authority in India that could take up the accountability to assist WazirX in the recovery of the stolen funds is not good, the venture capitalist believes.

“Despite repeated reminders from India's Web3 circle, the government has not set up any such body to monitor damage in such situations and to be in charge of consumer protection of funds and custody of their assets,” Pandya said.

Crypto analysts suspect the involvement of North Korea's Lazarus Group behind this sophisticated hack attack.

As of now, nobody from the Indian government has given a statement on WazirX's hefty breach. It is, however, notable that this week Indian finance minister Nirmala Sitharaman will be presenting India's union budget for FY 2024-2025. In the backdrop of WazirX's hack, the expectations of tax relief from the crypto circle have taken a hit.

One hot wallet of WazirX that was under the custody of Liminal was breached by the hacker last week on July 18, 2024. This wallet was multi-signature – which needed two transaction authorisations from WazirX and one from Liminal. After unethically accessing the signatures needed from WazirX, the hacker tricked Liminal into giving its authorisation as well.

Members from India's crypto fraternity have, from this incident, been asked to segregate their holdings into smaller units stored across multiple wallets to avoid such unfortunate outcome.

As per Nischal Shetty, the co-founder of WazirX, the team is working on ideas that may add value to its ecosystem in order to “help fill the void left by the stolen assets.”

Meanwhile, Srijan R Shetty, the co-founder of crypto firm Fuze, has reminded WazirX to make up their mind and release a statement on if they plan to drop the legal action against the hacker, which is “a big deterrent for even a white hat hacker to return funds.”