18 Jul 2024
WazirX: Multisig Payload Mismatch on Liminal Custody UI
WazirX: on 18 Jul 2024 a cyber attack on one Liminal-operated multisig wallet lost funds exceeding $230M. WazirX says the UI showed one transaction while a different payload was signed.
- Event date
- Incident typeExchange custody compromise
- Bug classSocial engineering
- Published
Loss, as sourced
Funds exceeding $230 million from one multisig wallet, per WazirX. Affected wallet 0x27fD43BABfbe83a81d14665b1a6fB8030A60C9b4.
Traceability
Primary sources
In brief
Root cause: Per WazirX: discrepancy between Liminal interface display and signed contents; suspects payload replaced to transfer wallet control. Six signatories (five WazirX, one Liminal); three WazirX Ledger signatures plus Liminal final approval; destination whitelist in place.
Timeline, as sourced: Per WazirX: Liminal custody from Feb 2023; incident and preliminary report 18 Jul 2024.
Account, as sourced
Claimed (WazirX) (report (opens in a new tab)): >$230M; UI/payload mismatch; Gnosis Safe and whitelist did not prevent the theft.
Unknown: Liminal's own technical account.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/wazirx-liminal-multisig-payload-2024