Crypto hacks and breaches are not unheard of. However, with the industry maturing day by day, many checks and balances deployed at the correct nodes at the right time have helped the industry effectively reverse the rise.
According to yearly reports on the total value stolen in crypto hacks and the number of hacks published by Chainalysis, the yearly total value stolen in crypto hacks rose from US$543 million in 2019 to US$3.3 billion in 2021, and US$3.7 billion in 2022, before briefly coming down to US$531 million in 2020. However, the value witnessed a significant drop in 2023, falling from US$3.7 billion in 2022 to US$1.8 billion in 2023. In 2024, the value rose again to US$2.2 billion but remained far less than the 2022 value.
While such hacks and breaches could be considered potential bottlenecks for any rapidly emerging industry, some breaches leave a lasting impression on industry participants and shape how they should perform in the future.
One such hack was that of WazirX. Discussing WazirX is even more relevant now, for it has just secured court approval for a US$235 million repayment. We would discuss what repayment entails and its significance in a while. But, before delving deeper, we must go back to the recent past to see what happened to WazirX.
A Brief Overview of the WazirX Security Breach
July 18th, 2024, was the date when WazirX, a leading crypto exchange based in India, witnessed a security breach. Team WazirX issued a statement saying that it had experienced a cyber attack on one of its multisig wallets, resulting in the theft of digital assets exceeding $230 million. This wallet was managed using Liminal’s digital asset custody and wallet infrastructure. As a result of the attack, WazirX’s ability to maintain 1:1 collaterals with assets was deeply impacted.
As an immediate response to the theft, the WazirX team filed an online police complaint on the National Cyber Crime Reporting Portal and processed a physical complaint. It also reported the incident to the Financial Intelligence Unit (FIU) India and CERT-In.
The team also reached out to 500+ exchanges to block the identified addresses. Moreover, WazirX announced a Bounty program to recover the stolen assets, offering rewards up to $10,000 worth of USDT for actionable intelligence leading to the freezing and recovery of the stolen funds. The team also decided to offer 10%, or up to $23 million, as White Hat Bounty.
Since the hack, WazirX has taken a series of steps, detailed in a day-wise chronicle available on the WazirX website. Notably, on December 6th, 2024, WazirX’s parent firm, Zettail Pte Ltd., filed an application with the Singapore High Court seeking permission to convene a meeting of its creditors to present and vote on a Scheme of Arrangement.
Prior to this, on October 17th, 2024, WazirX decided to file an affidavit detailing approximately 240,000 wallets with balances. The affidavit was intended to be filed with the High Court of Singapore and provided to creditors as part of the restructuring process for Zettail Pte Ltd.
Notably, the platform had also filed a moratorium application with the Singapore High Court on August 28th, 2024, as per an update published on that date. The application was filed under the Insolvency, Restructuring, and Dissolution Act 2018 to provide the necessary space to restructure the platform’s crypto liabilities through a scheme of arrangement.
All these interactions between the Singapore High Court and WazirX have received judicial responses. While we will discuss those responses in detail, we will briefly examine another crucial update in this case: the joint statement by the United States, South Korea, and Japan.
Joint Statement by the United States, South Korea, and Japan on Wazir X
A joint statement issued by the United States, South Korea, and Japan reportedly confirmed the involvement of North Korean hackers in orchestrating the WazirX attack. It was the first official attribution of the attack to North Korea by three nations together.
The joint statement identified the infamous Lazarus Group, a North Korea-affiliated hacking collective, as a key perpetrator.
“The DPRK’s cyber program threatens our three countries and the broader international community and, in particular, poses a significant threat to the integrity and stability of the international financial system.”
The Indian government has not yet officially commented on the development. However, reports suggest the attack has inspired calls for stricter regulations and public-private collaboration to safeguard digital assets.
Amidst all these global movements and discussions around the safety & security of digital assets, WazirX secured court approval for a US$235 million hack repayment.
Legal Green Light to Repay $235M Breach
On January 23rd, 2025, WazirX received Singapore Court approval to repay victims of the US$235 million hack by North Korea’s Lazarus Group. The users will recover up to 80% of the stolen funds.
If we delve deeper into the legal documents, the name on the application for the supplementary affidavit was Nischal Shetty, listed as Director with the Permanent Account Number BNTPS2268H. Nischal Shetty declared himself as the director of Zettai Pte Ltd (“Zettai”).
Pursuant to the directions made by the Honourable Judicial Commissioner Kristy Tan at the hearing of OA 1284 on January 22nd, 2025, Mr. Shetty confirmed Zettai’s commitment to providing the following documents to Scheme Creditors at least one week before the intended period during which the Scheme Creditors vote on the proposed Scheme:
These documents included:
- Zettai’s audited financial statements for the financial year ended March 31st, 2024.
- The results of independent verification of the figure for the Platform Assets.
- The results of independent verification of the figure for the unsecured liabilities associated with the cryptocurrency balances owed to Platform Users as of July 18th, 2024—the day of the hack.
- Kroll’s financial forecast and liquidation analysis.
- Zettai’s updated Explanatory Statement if there are any changes arising from the financial information or a statement of confirmation.
WazirX Parent Company Zettai’s Plans to Achieve the Disclosure Commitments
For the audited financial statements, the company committed to following up and working with its auditors to expedite the completion of the audit.
For Platform Asset Verification, the platform details what the platform assets refer to. For instance, the Net Liquid Platform Assets were defined as all token assets associated with the operations of the platform post-handover Period that are currently under the company’s control and can generally be dealt with or realized in short order.
The Illiquid Platform Assets were defined in the Scheme as token assets held in wallets controlled by Binance and identified by the company as being associated with the cryptocurrency balances of Platform Users (i.e., the Illiquid Wallet Assets) and the ERC-20 tokens stolen during the Cyber Attack (i.e., the Stolen Assets).
In the affidavit, it was proposed that the verification of the Platform Assets would be performed by Mr. Joshua Taylor of Alvarez & Marsal (SE Asia) Pte Ltd and Mr. Henry Anthony Chambers of Alvarez & Marsal Disputes and Investigations Limited.
Apart from platform assets, it was also proposed that the verification of the Platform Liabilities would be performed by A&M.
Finally, it was agreed and recorded in the affidavit that once the disclosure commitments were fulfilled, Zettai would proceed with the rest of the Scheme Meeting as intended or adjust the timelines as necessary if any amendments to the Explanatory Statement arose from the Disclosure Commitments, i.e., to account for the conducting of a Second Online Webinar.
What’s Going to Happen on the Field?
While these legal commitments continue to define the contours of how the settlement plan will work, the core focus remains Zettai’s—WazirX’s parent company—a commitment to a restructuring plan aimed at creditor recovery and avoiding liquidation through a court-supervised process. WazirX estimates that users may recover 75% to 80% of their account balances through token distributions, reports suggest.
Since reportedly no evidence of wrongdoing or misconduct by WazirX in the cyberattack could be ascertained, and the joint statement from the US, Japan, and South Korean governments attributed the attack to a North Korean group, WazirX will now initiate a user voting process, expected to conclude within three months, along with an independent third-party audit as mentioned above. If the majority of voters support the platform, the scheme will be implemented, and within 10 days, net liquid assets will be distributed to users based on their claims, including any gains from the bull market.
The court evidently supported a speedy resolution and quick distribution of funds as the best outcome for users.
It is relevant to mention here that, as part of the ongoing recovery efforts following the cyberattack, approximately $3M worth of USDT was successfully frozen, as reported by WazirX on January 17th, 2023. It marked an important milestone in safeguarding user interests and recovering stolen assets.
WazirX believed that this freezing of funds was crucial in highlighting aspects such as the inclination to act rapidly, focus on recovery, and stay committed to users, as WazirX believed every amount frozen and recovered strengthened its mission to safeguard assets and rebuild trust.
After putting out this statement on the freezing of funds, WazirX also listed in detail how its scheme of arrangement was better than liquidation for scheme creditors. The platform said the scheme of arrangement was advantageous over liquidation as it offered potentially higher recoveries compared to possible liquidation.
It also offered significantly faster access to distributions than under a possible liquidation and gave Scheme Creditors more ability to have a say in the overall process than in liquidation. Finally, the scheme of arrangement, according to WazirX, had higher potential for any market-driven upside via token distributions than in liquidation, where distributions would likely be made in fiat.
All these assessments have become more relevant now that court approval for scheme meetings has been granted. WazirX believes the opinion of the Singapore High Court marks another significant milestone in the restructuring process as it moves closer to the distribution of Net Liquid Platform Assets and restarting the WazirX platform.
The Future of WazirX
Overall, the future of WazirX looks better than ever before. It is also important to remember that the court has also granted the platform a 16-week moratorium, shielding Zettai from legal actions while it seeks to implement the plan.
As creditors join the review process of the proposed Scheme of Arrangement, which outlines how assets will be distributed and how the platform can resume operations, broader participation is anticipated among WazirX users, many of whom remained inactive.
Nischal Shetty, the WazirX founder, has reportedly expressed optimism about the proposal, stating that it offers the best chance for creditors to regain their assets and for the platform to rebuild.
In the days to come, the plan would translate into the reorganization of debts, the distribution of liquid assets to creditors, and the issuance of recovery tokens designed to facilitate further asset retrieval. The recovery tokens represent remaining claims and allow creditors to benefit from future platform profits and recovered assets. Hopes are high, and speculations are rife that WazirX will witness a relaunching of the platform with enhanced features such as a decentralized exchange and allocating future profits toward creditor recoveries over the next three years.
The creditors will meet online, while details of the voting process will be shared in the coming weeks. We have already listed why Zettai, the parent company of WazirX, believes the scheme to be more advantageous than other available alternate options.
While Zettai has understandably urged its creditors to support the scheme, reports suggest that many analysts are also of the opinion that WazirX’s plan would have far-reaching consequences going beyond the realm of the re-emergence of a singular platform.
The efforts of Zettai would serve as a test of Singapore’s legal framework for resolving complex financial disputes in the digital asset space. A successful restructuring could serve as a model for other companies faced with similar crises.
Altogether, all eyes are on WazirX as it could open new horizons for companies to become more trustworthy and committed to their users.
