WazirX Hack Incident Analysis by Cobo's Security Team
October 10, 2024
1 Incident Overview
On July 18, 2024, WazirX, an Indian cryptocurrency exchange, fell victim to a major cyberattack. The attackers targeted a multi-signature wallet by manipulating the signers into approving a malicious smart contract upgrade. This breach allowed them to illegally transfer approximately $230 million worth of digital assets into their own wallets.
2 Incident Analysis
Note: The following analysis is done by Cobo's security team. It is based on post-mortem reports from WazirX and Liminal Custody, on-chain data, and publicly available information. The information may be incomplete or contain errors. It’s advised to verify with the involved companies for full details.
Sources:
2.1 Wallet Configuration and Signature Exploits
The compromised wallet was a Safe (formerly known as Gnosis Safe) multi-signature wallet using a 4-of-6 signature scheme. Five keys were held by WazirX in hardware wallets, while the sixth was an HSM key from Liminal Custody. This HSM key operates based on authorizations from WazirX’s platform and serves as the final line of defense, validating the authenticity of transactions before signing them.
Under standard procedures, WazirX initiates a transaction through the Liminal Custody platform, where the destination wallet address must be pre-whitelisted. Three of WazirX’s five signers then confirm the transaction’s accuracy and sign it using their hardware wallets. Once Liminal Custody receives three valid signatures, it adds the final signature and submits the transaction to the blockchain.
Analysis of on-chain data shows that the attackers managed to acquire three valid signatures, with the fourth signature provided by the transaction initiator, Liminal Custody.
Here’s how the attack unfolded:
Transaction initiation: The three WazirX signers accessed the Liminal Custody platform via a bookmarked link or Chrome shortcut app and completed multi-factor authentication. They saw pending transactions for two GALA transfers and one USDT transfer, and signed these transactions using their hardware wallets. However, the signed transactions were actually for a smart contract upgrade rather than the expected token transfers. Due to this data mismatch, Liminal Custody rejected all three transactions.
Malicious Upgrade: The attackers obtained signatures from three WazirX signers by forging transactions and then submitted the malicious upgrade transaction to Liminal Custody, accompanied by three legitimate signatures.
Final Approval: Liminal Custody provided the final signature, and once the transaction was confirmed on the blockchain, the smart contract was upgraded. This allowed the attackers to illegally transfer funds to their own wallets.
Findings:
According to WazirX, the three signers used hardware wallets to secure their private keys. The attackers acquired signatures from the three signers by forging transfer transactions, indicating no private key leakage from the signers.
No breach was detected in Liminal Custody’s infrastructure. If Liminal Custody’s systems had been compromised, the attackers would not have needed to use the platform for the final transaction.
WazirX reported that the signers accessed the legitimate Liminal Custody platform via bookmarks and completed multi-factor authentication. Liminal Custody also logged three suspicious transactions, ruling out the possibility of WazirX logging into a phishing page that collected signatures.
Forensic analysis from WazirX indicates that the devices of the three signers were not compromised.
What potentially went wrong:
Given the above, attackers likely used techniques such as man-in-the-middle attacks, XSS attacks, or other zero-day exploits to display a counterfeit Liminal Custody interface to the WazirX signers, deceiving them into signing a malicious transaction.
Once the attackers had collected signatures from the three signers, they submitted the malicious contract upgrade transaction through an existing session to the Liminal Custody platform. This transaction successfully bypassed Liminal Custody’s risk controls and was confirmed on the blockchain.
2.2 Issues Exposed
Insufficient risk controls on Liminal Custody platform:
On-chain data shows that Liminal Custody signed the contract upgrade transaction, indicating that their firewall, which includes policy checks such as destination address whitelisting, did not function as intended.
Although Liminal Custody’s logs show that the platform detected and rejected three suspicious transactions, it failed to promptly alert WazirX signers to take immediate security actions.
Inadequate verification by WazirX signers:
During transaction signing, only the content displayed on the hardware wallets should be considered reliable. However, WazirX signers relied on transaction details shown on the Liminal Custody platform without cross-referencing them with the content on their hardware wallets. This oversight led to them inadvertently signing a transaction for a malicious contract upgrade.
3 Cobo's Solutions Against Cyberattacks
3.1 Comprehensive Risk Controls
Cobo Portal provides an extensive suite of risk control mechanisms designed to address the challenges of defending against evolving risks. Our robust risk control engine empowers clients to deploy both on-premises risk control solutions and on-chain, role-based access controls. Importantly, even in the event of a security breach at Cobo, both client-side and on-chain risk controls remain in place to ensure the continued security of user funds.
Transaction policies: Create both on-chain and off-chain transaction policies to automate transaction handling based on predefined conditions, such as auto-approval, auto-rejection, and approval quorum.
Governance policies: Define the number of admins needed to approve critical operations, such as removing a team member or freezing an organization.
User roles and permissions: Assign specific user roles to team members—Viewer, Spender, Approver, Operator, and Admin—or create custom user roles.
3.1.1 Transaction Policies
Off-chain transaction policies: Managed by Cobo Portal’s backend system, these policies offer detailed inspection of token transfers and smart contract interactions. For MPC Wallets, you can deploy custom risk control programs (i.e., callbacks) on your own MPC-TSS nodes. These programs run independently of Cobo and are deployed on clients’ premises, ensuring protection even if Cobo is compromised. In the WazirX incident, if the WazirX signers use MPC-TSS nodes with callback protection, attackers will not be able to obtain any unauthorized signatures.
On-chain transaction policies: Governed by smart contracts within the Cobo Safe framework, these policies include advanced features like transfer whitelists to block unauthorized transactions. If these on-chain whitelists had been implemented during the WazirX incident, attackers would not have been able to execute transactions outside the approved whitelists.
Read more on how to set up and manage off-chain and on-chain transaction policies on Cobo Portal.
3.1.2 Governance Policies
You can set governance policies to define who can approve certain actions, such as changing user roles or modifying permission. Depending on the action, the policy mandates approval from either at least 50% of the admins or from a single admin. Additionally, you can customize these rules to enable auto-approval, auto-rejection, or an approval quorum.
For more information on governance policies on Cobo Portal, please click here.
3.1.3 User Roles and Permissions
User roles enable you to assign specific permissions to members within your organization based on their roles. Cobo provides five built-in roles, and you can also create custom roles tailored to your specific requirements.
For more information on user roles and permissions on Cobo Portal, please click here.
3.2 24/7 Customer Support
We provide round-the-clock customer support. Our team is here to assist each client in identifying and addressing any potential security risks.
4 Cobo’s Security Infrastructure
Cobo maintains one of the industry’s most robust security frameworks, encompassing all aspects of our operations, including network infrastructure, employee terminals, and transaction processes. These measures are meticulously designed to provide 360-degree protection against all sorts of attacks, ensuring the integrity of our security environment.
4.1 Secure and Advanced Wallet Technologies
Cobo Portal integrates four wallet technologies into a single platform, delivering state-of-the-art security architecture and the industry’s broadest coverage of chains and tokens. To see the full list of supported tokens and chains, please click here.
Custodial Wallets: Feature advanced encryption and risk control mechanisms, a three-tier key storage architecture (hot-warm-cold), and 95% of funds stored securely in cold wallets with only 5% in hot and warm wallets.
MPC Wallets: Built on advanced Multi-Party Computation (MPC) cryptographic technology for secure key management. Cobo Portal provides two types of MPC Wallets: Organization-Controlled Wallets, (where organizations maintain full control over all funds), and User-Controlled Wallets (where the organization’s end users control their own funds)
Smart Contract Wallets: Supports various smart contract wallets, including Safe{Wallet}. Future updates will expand support to include other account abstraction wallets. Cobo Portal's Smart Contract Wallets offer the flexibility to delegate an Externally Owned Account (EOA) to perform authorized actions on behalf of Safe{Wallet} signers using a single signature. This feature significantly enhances operational efficiency while maintaining security.
Exchange Wallets: Consolidate multiple exchange accounts into a single interface to view, monitor, and manage your assets across various exchanges.
4.2 Cobo Guard
Cobo Guard is a versatile and secure iOS application to elevate the security of your digital assets while you are on the go.
Functions include transaction approvals, MPC key management, multi-factor authentication (MFA), and passwordless login.
Uses asymmetric encryption to generate a unique public and private key pair for each user, ensuring robust protection.
Public key is shared with Cobo, while your private key is securely housed within the Secure Enclave of your iPhone. This setup guarantees that all transaction approvals are signed with your private key and verified using the public key shared with Cobo.
Leverages cutting-edge biometric authentication (fingerprint scanning, Face ID, or PIN codes) to enhance the integrity of the authentication process.
Requires two-factor authentication for every transaction, significantly mitigating the risk of unauthorized access.
Cobo Guard parses transaction data into easily digestible formats, allowing approvers to make informed decisions at a glance.
4.3 Security Measures Against Phishing Attacks
Phishing is a prevalent cyberattack method due to its high profit and low cost. To combat these threats, Cobo has implemented several key security measures:
Advanced endpoint security to monitor and respond to potential threats in real-time.
Secure hardware keys to protect endpoints.
Granular permission controls to tightly regulate access.
Regular internal phishing training to enhance employee awareness against the latest threats.
4.4 Security Measures Against Other Cyberattacks
Cobo is highly respected in the industry for its vigilance against cyber threats. We employ stringent security protocols to ensure both system efficiency and complete protection. Since our inception in 2017, we have maintained a flawless track record of zero security incidents.
24/7 monitoring and maintenance to guarantee system availability.
Regular penetration testing and code audits.
Simulated attacks to continuously strengthen our cybersecurity posture.
Semi-annual penetration tests by leading security firms, with no issues ever identified.
Over 200 security policies governing Cobo’s infrastructure, supported by regular security inspections.
Resilience against DDoS attacks and capability to address common security vulnerabilities.
Achieved ISO 27001 and SOC 2 Type 1 and Type 2 certifications.
