Indian crypto exchange WazirX said approximately 45% (as per preliminary workings) of its crypto assets was affected by a cyber attack on July 18 that led to the loss of more than $230 million from one of its wallets.

Prior to the attack, the crypto exchange, which calls itself India’s largest by volume, said it held around $500 million in digital assets.

“As of June 10, 2024, at 6:30 PM, WazirX’s total holdings stood at an impressive ₹4,203.88 Crores (USDT 503.64 Million), marking a staggering 79% surge compared to the data shared in January 2023,” said WazirX in a previous statement, adding, “For two years running, WazirX has proudly held the position of the largest exchange by reserves, underscoring its status as a reliable and solvent platform for crypto enthusiasts.”

However, after the cyber-attack, we were unable to view the exchange’s proof of reserves page.

Screenshot of the ‘under maintenance’ screen seen when searching for WazirX’s proof of reserves | Photo Credit: Coin Gabbar

(Unravel the complexities of our digital world on The Interface podcast, where business leaders and scientists share insights that shape tomorrow’s innovation. The Interface is also available on YouTube, Apple Podcasts and Spotify.)

What happens next?

Apart from notifying the Indian police authorities and setting up several bounty programmes with rewards in order to trace the stolen assets, WazirX ran a poll in order to decide how to let users access their funds. In the end, the exchange decided on a “socialised loss strategy.”

“A socialized loss strategy is a method where the losses from a situation, such as a cyberattack, are shared among all crypto portfolio users in a fair and equitable way,” explained WazirX in a blog post, as it said that users will get only 55% of their tokens back, while the deducted assets will be locked/used as per WazirX’s discretion.

WazirX noted that the plan would apply to all investors with crypto assets. INR funds will remain accessible.

Two options were made available to users: Option A would let users trade within the platform without withdrawing their crypto assets and they could enjoy higher priority for recovery efforts, while Option B would let users withdraw their assets but with less priority for recovery efforts.

A screenshot of the message showing the two options users could pick from | Photo Credit: WazirX

Many WazirX users on X responded with shock and anger at the idea of losing their tokens, and called on WazirX to compensate users with its own profits instead. Others were upset that the valuation for the assets would be taken from the data for July 21, instead of July 18, which is when the hack took place. Several other WazirX users called on the exchange to publish an updated breakdown of its holdings and users’ assets after the cyber attack.

WazirX CEO Nischal Shetty said his team was working on figuring out more options and asked for users’ support to proceed. He refuted an X user who compared the situation to Sam Bankman-Fried’s collapsed crypto exchange FTX; Shetty claimed that WazirX’s cyber attack was not the same as FTX’s fund misuse.