Liminal Criticizes Wazirx for Failing to Implement Security Measures

Indian cryptocurrency exchange Wazirx has responded in detail to allegations and misinformation related to the Wazirx security breach and claims the company has made against it by Liminal Custody. Published Tuesday, the update, titled Wazirx Incident Update Response to Ongoing Disinformation Campaign, took on several stark issues in the caution in the crypto sector.

It all started when, in July 2024, Wazirx reported a massive hack which stole around $230 million in digital assets. Wazirx later blamed Liminal Custody for the breach, which quickly generated controversy and fog. Liminal responded to this with an update where it assured the company’s commitment to transparency and debunked as falsehoods what they say are erroneous claims about its involvement.

Liminal Highlights Wazirx’s Continued Use of Infrastructure

However, one of the main things that Liminal’s updated notes on their blog and also posted to Twitter tends to talk about is how Wazirx is still utilizing the infrastructure, while public accusations target them. Exchange blew the incident up on Twitter telling Liminal the blame lay with it and announced its rupture in an official statement in August. But, Liminal says that the reality looks very different than that.

Wazirx responded immediately to the breach by releasing a statement on August 14, 2024, that it had ‘terminated’ the contract with Liminal Custody, the custodial firm had said. However, as opposed to cutting ties, the Indian cryptocurrency exchange kept using Liminal’s infrastructure to handle user funds.

In fact, Crypto Exchange was still holding more than $175 million worth of assets, through Liminal’s platform, 75 days after the breach. Liminal said that at the time of the announcement, about $50 million in user assets were in wallets that could also be accessed via the Liminal systems.

It also denied that it was responsible for the breach and said it did not control the wallets in question. Exchange, they stressed, was responsible for initiating or transferring the funds at any time, and they had complete control over the funds.

Advertisement Banner

Liminal Analyzed 240,000 Addresses Linked to Wazirx’s Wallets

Along with the update, Liminal also claimed that Wazirx did not take the necessary steps to secure the service, which Liminal insists could have prevented the hack. Indian Cryptocurrency Exchange did not include critical infrastructure features, including smart refill transactions, the custodial firm said. The two features that are supposed to improve the security around cold wallet operations could have prevented wallet signatures that were being attacked from being exposed.

Civil rights groups Liminal criticized Wazirx for not doing enough to protect its assets, which it said likely exacerbated the scale of the breach. It is unfortunate that the Indian Cryptocurrency Exchange didn’t adopt these security practices, leaving them vulnerable and their wallets compromised.

Liminal also explained that the 240,000 addresses it received from the Singapore court as addresses linked to Wazirx’s wallet included Liminal’s own results from their own analysis of those addresses. Most of the addresses, the custodial firm said, were hot wallets, which are more susceptible to hacking since they are always connected via the internet. However, only a small proportion of the wallets under Liminal’s management were impacted.

For many days, these handful wallets held the balance funds of around $300 million, and for many months after the incident, the balance funds of around $177 million were in Liminal. Liminal’s systems had held Wazirx’s assets for a long time after the breach, suggesting the Indian Cryptocurrency Exchange had a significant amount tied up in Liminal’s systems.

Conclusion

Wazirx had breached Liminal Custody’s defence that it played a minor role in safeguarding bitcoins belonging to Wazirx, as it was only responsible for the transmission of funds from Coinbase to the exchange. The company observed that Wazirx was also unable to implement basic security measures. As the investigation unfolds, transparency and security were both important in managing digital assets, said Liminal.

Stay updated with TheBit Journal by following us on Twitter and LinkedIn and joining our Telegram channel.