Dr. Sunando Roy
The cryptocurrency landscape has long been plagued by security breaches, but the WazirX and Bybit hacks stand out due to their complexity, scale, and implications. Both incidents demonstrate the evolving nature of cyber threats against centralized exchanges (CEX), emphasizing vulnerabilities in multi-signature wallets and smart contract security. While WazirX suffered a $230 million breach due to a compromised multi-signature wallet, Bybit lost approximately $1.4 billion in Ethereum from a cold wallet attack, which exploited a smart contract vulnerability. Despite their differences, both cases reveal striking similarities in how attackers manipulated transaction authentication mechanisms.
The WazirX hack, which occurred on July 18, 2024, involved the attacker gaining unauthorized control over a multi-signature wallet by manipulating the required authorizations. The exchange’s Ethereum hot wallet, secured through Liminal’s custody infrastructure, required four out of six signatures to authorize transactions. The attackers deceived both WazirX and Liminal into approving a fraudulent smart contract, thereby bypassing security measures and executing large unauthorized transfers. The stolen funds were subsequently laundered through Tornado Cash and various decentralized exchanges, making tracking and recovery more difficult. Speculation suggests that North Korean state-sponsored hackers, particularly the Lazarus Group, may have orchestrated the breach, though concrete evidence is lacking.
On the other hand, the Bybit hack on February 21, 2025, targeted one of the exchange’s Ethereum cold wallets. The attackers exploited a vulnerability in the Safe (safe.global) multi-signature smart contract system. Using a technique known as DelegateCall, they tricked the signatories into approving a transaction that replaced the wallet’s smart contract logic with a malicious one. This allowed the attackers to execute backdoor functions and withdraw funds while making it appear as though a legitimate transaction was taking place. Bybit’s CEO, Ben Zhou, revealed that he was the final signer on the transaction, believing he was authorizing a routine cold-to-warm wallet transfer. However, the interface he used had been manipulated to display misleading information, making it nearly impossible to detect the fraud in real time.
One key distinction between the two incidents is the attack vector. WazirX’s breach was primarily a social engineering and governance attack on its multi-signature process, whereas Bybit’s was a smart contract-level manipulation that exploited the DelegateCall function. In the WazirX hack, the attackers focused on deceiving human operators into granting access. In contrast, the Bybit attackers executed a more technical strategy, targeting the underlying code of a trusted wallet infrastructure, although, as things transpired, human element also played a role.
Another notable difference is the scale of financial damage. Bybit lost significantly more—$1.4 billion—compared to WazirX’s $230 million. This makes it by far the largest single-incident thefts in crypto history. Additionally, the market reaction was immediate, with Ethereum prices experiencing sharp fluctuations as news of the heist spread. Bybit’s hack also showcased the limitations of smart contract-based multi-signature wallets, as the exploit took advantage of a trusted security service rather than directly breaching an exchange’s operational infrastructure.
Despite these differences, both cases underline critical vulnerabilities in centralized exchange security. The reliance on multi-signature wallets, while generally more secure than single-key systems, still presents risks if signatories can be deceived or if smart contract implementations have exploitable flaws. The incidents also emphasize the growing need for improved transaction verification processes, especially for high-value transfers. Technologies such as Multi-Party Computation (MPC) have been proposed as a more secure alternative to multi-signature wallets, as they eliminate reliance on a single contract or signatory group, thus reducing attack vectors.
In response, both exchanges have implemented emergency measures, including freezing transactions and working with blockchain analytics firms to track stolen funds. However, as history has shown, recovering stolen crypto assets remains a significant challenge, particularly when mixing services like Tornado Cash are used. Furthermore, these breaches highlight the importance of proactive security audits, better education for signatories, and more transparent risk disclosures for users trusting CEX platforms with their funds.
Ultimately, the WazirX and Bybit hacks serve as stark reminders that, despite advances in blockchain security, attackers continue to find ways to exploit both human and technical weaknesses. The cryptocurrency industry must adapt by strengthening security frameworks, improving internal controls, and reducing reliance on single points of failure. Otherwise, such high-profile breaches will continue to undermine trust in centralized platforms, pushing more users toward decentralized alternatives.
Glossary of Technical Terms
1. Multi-Signature (Multi-Sig) Wallet – A wallet that requires multiple private key holders to approve a transaction, increasing security.
2. Cold Wallet – A cryptocurrency wallet that is kept offline to prevent unauthorized access.
3. Hot Wallet – A cryptocurrency wallet connected to the internet for easy transactions but more vulnerable to attacks.
4. Smart Contract – Self-executing contracts with terms written in code, often used in blockchain transactions.
5. DelegateCall – A function in smart contracts that allows execution of external contract code within the calling contract’s context, often exploited in attacks.
6. Tornado Cash – A crypto mixing service that obfuscates the origin and destination of transactions, commonly used for laundering stolen funds.
7. MPC (Multi-Party Computation) – A cryptographic method that eliminates single points of failure in key management by distributing control among multiple parties.
8. Lazarus Group – A North Korean cybercriminal group known for large-scale financial and crypto heists.
9. Ethereum (ETH) – A blockchain network known for its smart contract functionality, often targeted in major crypto hacks.
10. CEX (Centralized Exchange) – A cryptocurrency exchange managed by a central authority, in contrast to decentralized exchanges (DEXs).
Leave a Reply