What Went Wrong with WazirX? Unraveling India’s biggest crypto hack
WazirX 出了什么问题？揭秘印度最大的加密货币黑客事件
发布: 2024/08/02 15:24 阅读: 613
On July 18, WazirX, a Leading Indian Cryptocurrency Exchange, Suffered a Massive Cyberattack
7月18日，印度领先的加密货币交易所WazirX遭受大规模网络攻击
On July 18, WazirX, one of India's prominent cryptocurrency exchanges, experienced a devastating cyberattack, resulting in the loss of approximately $234.9 million (Rs 2000 crore) in investor funds.
7 月 18 日，印度著名的加密货币交易所之一 WazirX 经历了毁灭性的网络攻击，导致投资者资金损失约 2.349 亿美元（200 亿卢比）。
The Aftermath: Shock, Anger, and Investigation
后果：震惊、愤怒和调查
The attack has left thousands of WazirX users in shock, exasperation, and trepidation regarding their investments. Numerous investigative agencies, including the FBI, and crypto sleuths have launched inquiries into the incident, but no significant progress has been made. The subsequent events have been characterized by evasiveness from the platform's owners amidst growing anxiety within India's crypto community.
这次攻击让数千名 WazirX 用户对他们的投资感到震惊、愤怒和恐惧。包括联邦调查局（FBI）在内的众多调查机构和加密货币侦探已对该事件展开调查，但尚未取得重大进展。随后发生的事件的特点是，在印度加密社区内部日益焦虑的情况下，该平台所有者的回避态度。
What Transpired on July 18?
7月18日发生了什么？
On July 18, cybersecurity firm Cyvers Alerts reported a substantial breach in WazirX's multi-sig wallet, with unauthorized transactions transferring funds worth $234.9 million to another wallet on the Ethereum network. The stolen assets constituted a significant portion of WazirX's investor funds, as indicated in their June 2024 proof of reserve report, which valued total holdings at $503.64 million. Subsequently, WazirX's official Twitter account confirmed the hack and suspended all withdrawals from its platform.
7 月 18 日，网络安全公司 Cyvers Alerts 报告称，WazirX 的多重签名钱包出现重大漏洞，未经授权的交易将价值 2.349 亿美元的资金转移到以太坊网络上的另一个钱包。正如 2024 年 6 月的准备金证明报告所示，被盗资产构成了 WazirX 投资者资金的很大一部分，该报告的总资产价值为 5.0364 亿美元。随后，WazirX 官方 Twitter 账户证实了此次黑客攻击，并暂停了其平台的所有提款。
The Extent of WazirX's Loss
WazirX 的损失程度
Blockchain explorer Lookonchain provided detailed information on the stolen assets, which included over 200 distinct cryptocurrencies. Notably, the attack involved 5.43 billion SHIB tokens, over 15,200 Ethereum tokens, 20.5 million Matic tokens, 640 billion Pepe tokens, 5.79 million USDT, and 135 million Gala tokens. The substantial volume of stolen assets has impacted the market value of these cryptocurrencies and WazirX's overall industry standing.
区块链浏览器 Lookonchain 提供了被盗资产的详细信息，其中包括 200 多种不同的加密货币。值得注意的是，此次攻击涉及 54.3 亿个 SHIB 代币、超过 15,200 个以太坊代币、2050 万个 Matic 代币、6400 亿个 Pepe 代币、579 万个 USDT 和 1.35 亿个 Gala 代币。大量被盗资产影响了这些加密货币的市场价值和 WazirX 的整体行业地位。
Possible Causes of the Security Breach
安全漏洞的可能原因
Potential explanations for the security breach include vulnerabilities, insufficient security protocols, weak API security, inadequate monitoring and response systems, or outdated software. Given WazirX's stature as one of India's major exchanges, these concerns are both surprising and alarming, raising questions about their security measures' overall robustness and preparedness for such an attack.
安全漏洞的可能解释包括漏洞、安全协议不足、API 安全性薄弱、监控和响应系统不足或软件过时。鉴于 WazirX 作为印度主要交易所之一的地位，这些担忧既令人惊讶又令人担忧，引发了对其安全措施的整体稳健性和针对此类攻击的准备程度的质疑。
Lazarus Group's Suspected Involvement
Lazarus 集团涉嫌参与
Some security experts have implicated the Lazarus Group, a notorious North Korean hacking collective, as a potential culprit. This group has been linked to several high-profile cryptocurrency attacks in recent years. In June 2023, for example, the Lazarus Group targeted Atomic Wallet, stealing over $35 million worth of cryptocurrency. They employed sophisticated techniques, such as phishing attacks to obtain private keys and cryptocurrency mixers to launder stolen funds. The group's history of targeting exchanges and wallets to finance North Korea's regime raises concerns that they may also be responsible for the WazirX attack.
一些安全专家认为臭名昭著的朝鲜黑客组织 Lazarus Group 是潜在的罪魁祸首。近年来，该组织与多起备受瞩目的加密货币攻击有关。例如，2023 年 6 月，Lazarus 集团瞄准了 Atomic 钱包，窃取了价值超过 3500 万美元的加密货币。他们采用了复杂的技术，例如网络钓鱼攻击来获取私钥和加密货币混合器来洗钱被盗资金。该组织以交易所和钱包为目标为朝鲜政权提供资金的历史引发了人们的担忧，即他们也可能对 WazirX 攻击负责。
Blockchain evidence suggests that the stolen assets are being sold on the decentralized exchange Uniswap. Risk management firm Elliptic has established links between the hackers and the Lazarus Group, bolstering the suspicion that this attack was orchestrated by a highly skilled and well-resourced hacking organization.
区块链证据表明，被盗资产正在去中心化交易所 Uniswap 上出售。风险管理公司 Elliptic 已在黑客和 Lazarus Group 之间建立了联系，进一步怀疑此次攻击是由技术精湛且资源充足的黑客组织精心策划的。
Insider Attack Speculation
内部攻击猜测
There is also speculation about an insider's involvement in the hack. An insider with privileged access to sensitive data or systems could have facilitated the breach or played a role in some capacity. Inadequate segregation of duties and privileges within the exchange may have facilitated abuse of access for malicious purposes. Moreover, phishing attacks and other social engineering tactics could have contributed to the breach.
还有关于内部人员参与黑客攻击的猜测。拥有敏感数据或系统特权访问权限的内部人员可能促成了此次泄露或以某种身份发挥了作用。交易所内职责和特权的不充分分离可能会助长出于恶意目的的滥用访问。此外，网络钓鱼攻击和其他社会工程策略也可能导致了此次泄露。
WazirX's Response: Controversial "55/45" Compensation Plan
WazirX的回应：有争议的“55/45”补偿计划
WazirX's immediate suspension of withdrawals left many customers stranded, unable to access their funds during the critical recovery period.
WazirX 立即暂停提款，导致许多客户陷入困境，无法在关键的恢复期间提取资金。
The compensation plan offered by WazirX has been met with criticism. The exchange proposed a "55/45" loss-sharing ratio for users. Under this arrangement, users with 100% of their tokens in the "not stolen" category would receive 55% of those tokens back, while the remaining 45% would be converted to USDT-equivalent tokens and locked. WazirX co-founder Nischal Shetty claimed that this approach aimed to distribute the loss impact fairly, but it has been poorly received by customers.
WazirX 提供的补偿计划遭到批评。交易所提出了用户“55/45”的损失分担比例。在这种安排下，100%的代币属于“未被盗”类别的用户将获得其中55%的代币，而剩余的45%将被转换为等值的USDT代币并被锁定。 WazirX 联合创始人 Nischal Shetty 声称，这种做法旨在公平分配损失影响，但客户反响不佳。
Many customers have demanded a CBI investigation against WazirX owners and sought clarification on various aspects of the breach, including the attack details, external security audits, asset management, trading suspension, insurance, and the timetable for resuming withdrawals.
许多客户要求 CBI 对 WazirX 所有者进行调查，并要求澄清违规行为的各个方面，包括攻击细节、外部安全审计、资产管理、交易暂停、保险以及恢复提款的时间表。
Eroding Trust: WazirX's True Loss
信任被侵蚀：WazirX 的真实损失
Over two weeks have passed since the attack, but the exchange has failed to provide a comprehensive and satisfactory response, further fueling customer outrage. The exchange's handling of the situation has been criticized, and questions remain about whether the compensation plan adequately addresses the needs of affected users. WazirX has acknowledged the criticism and expressed openness to feedback and exploring alternative resolution measures.
袭击事件已经过去两周多了，但该交易所未能提供全面、令人满意的回应，进一步加剧了客户的愤怒。该交易所对这一情况的处理受到了批评，补偿计划是否充分满足受影响用户的需求仍然存在疑问。 WazirX 承认了这些批评，并表示愿意接受反馈并探索替代解决措施。
As time goes on, WazirX is likely to lose more customers if they cannot develop a concrete compensation plan.
随着时间的推移，如果WazirX无法制定具体的补偿计划，他们可能会失去更多客户。
Lessons for Other Indian Exchanges
其他印度交易所的经验教训
Following the hack, prominent Indian crypto exchanges like CoinSwitch and CoinDCX have reassured their customers about the security of their funds. CoinDCX CEO Sumit Gupta emphasized the robustness of their wallet security, while CoinSwitch's Ashish Singhal advised investors to exercise caution during this volatile period. These exchanges have taken proactive steps to ensure the security of their systems and the protection of customer assets in cold wallets.
黑客事件发生后，CoinSwitch 和 CoinDCX 等著名的印度加密货币交易所向客户保证了资金的安全。 CoinDCX 首席执行官 Sumit Gupta 强调了其钱包安全的稳健性，而 CoinSwitch 的 Ashish Singhal 建议投资者在这个动荡时期保持谨慎。这些交易所已采取积极主动的措施来确保其系统的安全并保护冷钱包中的客户资产。
WazirX has faced various challenges in recent years, including a significant fallout with Binance in early 2023. The exchange's separation from Binance, after a dispute over ownership, has further complicated its situation.
近年来，WazirX 面临着各种挑战，包括 2023 年初与币安的重大冲突。在所有权纠纷后，该交易所与币安的分离使其处境进一步复杂化。
Conclusion
结论
The WazirX hack serves as a sobering reminder of the vulnerabilities that even major crypto exchanges can face. It underscores the need for enhanced security measures, clear communication, and robust incident response plans. Despite the current difficulties, there is still hope that WazirX can recover from this incident. The exchange's commitment to transparency, user support, and recovery efforts will be crucial in determining how well it can rebuild trust and continue operations.
WazirX 黑客事件清醒地提醒人们，即使是主要的加密货币交易所也可能面临一些漏洞。它强调需要加强安全措施、清晰的沟通和强大的事件响应计划。尽管目前困难重重，但 WazirX 仍有望从此次事件中恢复过来。该交易所对透明度、用户支持和恢复工作的承诺对于决定其重建信任和继续运营的能力至关重要。
近期新闻
更多>- 同性恋 Pepe Solana Memecoin 在交易所上市前上涨 18,000%，而 SHIB、BONK 和 DOGE 崩盘 01-01
- BTFD 预售吸引了最佳新 Meme 代币预售的投资者，PEPE 和 SPX6900 主导了市场，带来了可观的回报... 01-01
- 同性恋 Pepe (HOMOPEPE) Solana Memecoin 在交易所上市前上涨 18,000%，而 SHIB、BONK 和 DOGE 崩盘 01-01
- 指标表明 WIF、JASMY 和 PEPE 在 2025 年具有巨大潜力 01-01
- 在 Pepe 和 Moo Deng 的加密炒作中，BTFD 币的预售不容错过：本周将加入最佳 Meme 币预售 01-01
- 同性恋 Pepe (HOMOPEPE) Solana Memecoin 在交易所上市前上涨 18,000%，而 SHIB、BONK 和 DOGE 崩盘 01-01
- 下一季度的加密宝石：最值得关注的 5 个代币 01-01
- 为什么 $PEPE 今天上涨 20%，下一个可能是哪种代币 01-01
- 短期最佳新 Meme 代币：BTFD 在预售中筹集了 470 万美元，BONK 拥有低成本交易，PEPE 拥有稳定的追随者... 01-01
精选专题
更多>>-
- pepecoin 价格分析
- 本主题提供与 PepeCoin 价格相关的文章，涵盖 PepeCoin 的关键见解和分析
-
- 佩佩：模因明星
- 本主题提供与最有前途的模因 PEPECOIN 相关的文章，该项目有潜力成为主流数字货币。具有去中心化、可靠、易用、速度快、成本低、可扩展等优点，预计未来会得到更广泛的应用
-
- Pepecoin 价格预测
- 我们收集了有关 pepecoin 成功故事的事实，并提供了 pepecoin 价格预测
精选文章
更多>>- 1 Avalanche 和 Aptos 竞争对手在两周内筹集了超过 60 万美元
- 2 今日加密货币价格：随着 BTC、Pepe Coin、SEI 的上涨，市场继续上涨
- 3 主要加密货币分析师托尼看好这些模因币，但其中有一个脱颖而出
- 4 MTAUR 准备好粉碎 DOGE 和 PEPE：即将到来 100 倍的价格增长吗？
- 5 Memecoins 在 2024 年激增，Popcat 年初至今涨幅达 7,621%，领先于顶级加密代币
- 6 PEPE Meme 币重创 ATH——看看去年投资 83 美元的 Pepe 币现在值多少钱
- 7 错过了《被解放的佩佩》吗？别担心，这款新的 Pepe 主题 Meme 代币将在 2025 年带来更大收益
- 8 前 4 名山寨币 70% 折扣 – 最后机会！
- 9 聪明的 $Pepe 交易员在市场下跌期间获利 1170 万美元
- 10 狗狗币创造者向 NBA 传奇人物斯科蒂·皮蓬提议 DOGE