In the aftermath of a recent hack on India-based crypto exchange WazirX, multiparty computation (MPC) wallet provider Liminal stood firm in its assurance that its infrastructure remained secure and was not compromised in any way. In a post-mortem report released on July 19, Liminal made it clear that the breach at WazirX was not a result of any flaws in their user interface (UI) but rather a consequence of compromised devices within the exchange’s network.
According to Liminal’s report, the breach that led to an estimated loss of $235 million on July 18 was due to three compromised devices within WazirX’s infrastructure. The firm explained that its multi-signature wallet system was set up to provide a fourth signature if three valid signatures were received from WazirX, creating an opening for exploitation by the attacker. The attack was initiated when one of WazirX’s compromised devices made a legitimate transaction involving Gala Games tokens (GALA), altering the transaction hash to deceive Liminal’s server into approving a transfer of funds to the attacker’s Ethereum account.
While Liminal refuted claims by WazirX that their servers displayed incorrect information, pointing instead to compromised devices as the source of the attack, critical questions remain unanswered. Notably, how the attacker gained initial access to the three compromised devices at WazirX is a puzzling aspect that raises concerns about the security protocols in place. Liminal suggested the possibility of a sophisticated man-in-the-middle (MIM) attack or a similar client-side compromise as the likely means of infiltration.
In response to the breach, WazirX announced its intentions to collaborate with law enforcement and pursue additional legal actions to address the security incident. The immediate plan of action includes tracing the stolen funds and conducting a comprehensive analysis of the breach in partnership with forensic experts to recover customer funds. The integration of MPC technology in crypto security remains a work in progress, with incidents like the WazirX hack underscoring the need for constant vigilance and innovative solutions to safeguard digital assets.
