India’s Biggest Crypto theft: 234 millions dollars hacked

The Biggest Crypto Theft in India






In India, digital assets worth ₹2,000 crore (approximately $234 million) vanished within minutes from a major crypto exchange named WazirX, sparking questions over how such a secure system was hacked and who the culprits were.

On 18 July 2024, hackers allegedly stole around 45% of WazirX's reserves.

At the time, WazirX was considered India’s largest crypto exchange, with over 16 million users.

Exactly a year later, another Indian exchange, CoinDCX, suffered a theft of $44 million this month.

Earlier in the same year, crypto exchange Bybit was hacked, with $1.5 billion worth of digital tokens stolen, making it the largest crypto theft in history.

Crypto exchanges function like banks, except they use digital currency instead of fiat money and enable online buying and selling. The key difference is that banks are government-regulated, whereas crypto exchanges are often unregulated.

After the theft, WazirX froze all user accounts, which remain frozen to this day. Most of these accounts belong to Indian citizens.

WazirX claims it is working to return the lost and frozen funds to users, but many questions remain unanswered about how the digital currency was stolen.

It's important to clarify that crypto trading is not banned in India, but the government does not regulate it officially—something crypto investors in India are generally aware of.

The Indian government began investigating the WazirX theft in October 2024, but no concrete outcomes have been made public so far.




Suffered the Loss?




The victims range from crypto hobbyists to seasoned investors, who now find themselves battling the complexities of an emerging technology.

Neeraj Gupta, a businessman from Bangalore, says he lost around ₹1 crore due to the theft.

Gupta considered his crypto holdings a long-term investment and is hopeful WazirX will eventually return his funds.

He said, "I thought exchanges do get hacked, but since every transaction is recorded on secure blockchain technology, I expected WazirX would recover the funds quickly. But this 'high-tech' system did not live up to expectations."





How Did the Theft Happen?




There is still no clear answer to how a system based on transparent and secure blockchain technology, with strong security measures, was breached.

Several independent cybersecurity firms concluded that the hackers manipulated the exchange’s permission system, which was supposed to prevent unauthorized transactions.

Crypto exchanges use a wallet system—reserves are usually stored in cold wallets (offline) and only small amounts are transferred to hot wallets (online) for transactions, to limit losses in case of theft.

The theft happened in WazirX’s hot wallet.

Co-founder Nischal Shetty told that the team noticed the hot wallet balance dropping, even as large withdrawal requests came in from a user.

To meet the requests, the team transferred additional tokens from the cold wallet to the hot wallet.

WazirX had a multi-signature approval system: any transaction required authorization from at least four people—three approvals from WazirX and one from Liminal, a Singapore-based firm.

Liminal’s approval was an extra layer meant to monitor and stop suspicious or unauthorized transactions.

However, researchers believe hackers tampered with transaction data, misleading both WazirX and Liminal into approving a malicious transaction.

Shetty said the team realized what was happening within 30 to 60 minutes, but by the time they acted, the hackers had vanished with $234 million, leaving no trace.



Who s esponsible?


WazirX maintains that the theft did not originate from their system, and they have blamed Liminal for approving the final transaction.

Nischal Shetty stated, “We are still waiting for a full explanation from Liminal, since it was their system we were using.”


Shetty cited an audit by Mandiant, a Google-owned cybersecurity firm, which found no suspicious activity on the three WazirX laptops used in the transactions.


Critics argued the audit was too limited and that more investigation is needed to fully understand the breach.

Some users believe the theft may have involved insider collusion.

Romy Johnson, who is campaigning for fund recovery, told a court that the misuse of approvals suggests the thief had access to wallets or administrative controls, which are only available to trusted high-level insiders.

On the other hand, the governments of the US, Japan, and South Korea officially blamed North Korea’s “Lazarus” hacking group, known globally for targeting crypto platforms.

Lazarus was also behind the $1.5 billion Bybit hack in 2025, the $625 million Ronin Bridge hack in 2022, and the $101 million Bangladesh Bank digital heist in 2016.





Impact and Legal Complexities.



The theft forced WazirX to shut down operations, shattering years of built-up trust.

A data engineer who lost several lakhs in the hack said users trusted WazirX to safeguard their money, and "if the funds were stolen, the company must return them in full."

Instead, the company froze every user's account, even those who were not affected by the hack.

Romy Johnson, whose ₹20 lakh worth of crypto assets remain frozen, said this move unfairly punishes users.

“Even if I get my money back, it will be only partial. This is a massive theft of my funds, and I did nothing wrong.”




Why Was WazirX So Popular in India?




Chartered accountant Sonu Jain, a WazirX user based in Bangalore, said the exchange branded itself as ‘India's Crypto Coin Exchange’, which worked to its advantage.

As the platform grew, the world’s largest crypto exchange, Binance, claimed in 2019 that it had acquired a stake in WazirX, further boosting public trust.

(Later, when Indian investigative agencies began probing WazirX for money laundering, Binance withdrew this claim. WazirX denies all allegations and maintains that it is owned by Binance.)

Jain said WazirX’s popularity surged mainly due to its alleged Binance affiliation.

Romy Johnson added, “We were proud to open accounts with WazirX, but in truth, it was a crypto exchange operating in India, but not wholly owned by an Indian company.”



Why Are the Investigations So Complex?


Despite the inherent risks in crypto trading, many WazirX users say they made good profits before the hack.

Sonu Jain said several of his clients, whom he advised as a chartered accountant, lost ₹7–8 crore.

Most of them only used WazirX, and their entire net worth was tied up on that platform.

“They invested because WazirX was sold to them as an Indian institution.”

Many users admit the hacking is beyond their comprehension.

Not only is international cybercrime highly technical, but India’s lack of crypto regulation makes the situation worse.

In November 2024, Delhi Police arrested a man from West Bengal, whose wallet (sold to an unknown party before the hack) was allegedly used in the theft.

It’s still unclear how Lazarus gained access to that wallet.

Legal Action and Future Prospects
In an effort to recover funds, Indian users approached the courts, arguing that since they traded in Indian currency on WazirX and paid crypto-related taxes to the Indian government, the company should be held accountable in India and the government should intervene.

However, in April, India’s Supreme Court dismissed the petition, stating that crypto is an unregulated sector and advised petitioners to seek help from financial and regulatory bodies instead.

Separately, in August 2024, WazirX appealed to Singapore’s High Court (where its parent company is based) and proposed a partial fund recovery plan for users.

The court approved the plan, and the company has stated it will now seek user input on how the reimbursements should be executed.