Analysis of the $235 million theft from Indian exchange WazirX

On July 18, 2024, according to Beosin Alert monitoring and early warning, the Indian exchange WazirX was attacked. The attacker obtained the signature data of the exchange's multi-signature wallet administrator, modified the wallet's logical contract, and made the wallet execute incorrect logic to steal assets, involving funds exceeding US$235 million.

Based on the attacker's attack behavior, it is speculated that the cause is the leakage of the administrator's private key of the multi-signature wallet. Beosin briefly analyzes the cause of the attack as follows:

Attacker address:

0x6eedf92fb92dd68a270c3205e96dccc527728066

Attacked address:

0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4

First, the attacker deploys the attack contract:

0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4.

The function of this contract is to extract the token assets specified by this contract.

In the second step, the attacker obtains the signature data of the administrator of the wazirx multi-signature wallet and modifies the logical contract of the wallet to the deployed attack contract.

The corresponding transaction is:

https://etherscan.io/tx/0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d

In the third step, the attacker submits a token withdrawal transaction to the wazirx multi-signature wallet. Due to the mechanism of the proxy mode, the wallet contract will use delegatecall to call the relevant functions of the attack contract and transfer the wallet tokens.

Beosin Trace tracks the stolen funds, and the flow chart of the stolen funds shows that the hacker has transferred part of the funds to Changenow and Binance exchanges, of which 0xf92949ab576ac2f8dc9e4650e73db083f1f9cd9f is the hacker's deposit address on Binance.

On the other hand, the hacker transferred 801 billion SHIB to the address 0x35fe...745CA in the past two hours, with a value of up to 14.02 million US dollars, and is continuing to sell in batches. At present, the hacker's address still holds 4.9 trillion SHIB, with a total value of 86.52 million US dollars.

Beosin Trace is continuing to track the stolen funds.