In the high-risk and unregulated world of cryptocurrencies, things got even murkier this month. WazirX, India’s biggest crypto exchange, was hit by a cyberattack. Hackers wiped off nearly half of the holding assets, amounting to $230 million, from one of its multi-signature wallets.

Considered highly secure, multi-signature wallets require (as the name suggests) multiple signatures, or private keys, to authorize a transaction. Each private key generates a signature, and a transaction request must be signed by the required number of keys before it is broadcast to the blockchain network. The network then verifies and includes the transaction in a block.

There’s more. As a result of this, not only did WazirX temporarily freeze all assets and withdrawals, it also made only 55% of crypto assets available for trading activity—basically, the $230 million in hacked cryptocurrencies constituted 45% of customer funds. In essence, this means that even if your account was not compromised in the cyberattack, you had access to only 55% of your assets. It called this a “socialised loss strategy”.

On the face of it, it may seem like a decently intentioned move, but it brought WazirX a lot of flak and criticism. Let’s understand why. To do that, we first need to understand what exactly happened.

WazirX gets attacked: Based on the company’s day-wise report, here’s what we know so far:

The cyberattack took place on 18 July.
The compromised multi-signature wallet was held by six signatories: five from WazirX and one from Liminal, WazirX’s wallet provider. Transacting funds from a multi-signature wallet requires the approval of its signatories who have a hardware key that helps authorize their connection to the wallet. It's similar to how bank vaults have multiple keys. Liminal helps store the tokens (a token is a digital unit on the blockchain network to which monetary value can be assigned) and handles the sign-in interface for the wallet.
At least three WazirX signatories had to approve each transaction using their hardware keys. Liminal also had a whitelist policy that was used to ensure transactions were only sent to approved addresses.
WazirX maintains the keys weren't compromised, but an external forensic audit will be conducted anyway to help verify if the three WazirX keys were breached.
Liminal is investigating how it approved the malicious payload, as four points of failure are needed for such an attack.

It is suspected that the attack—where users lost about $230 million in multiple cryptocurrencies—was masterminded by subgroups within the North Korean Lazarus Group. It has been alleged that their operations are state-sponsored, with the objective of generating revenue for the heavily sanctioned regime of the Democratic People's Republic of Korea. In WazirX’s case, $96.7 million was lost in Shiba Inu, $52.6 million in Ether, $11 million in Matic and $7.6 million in Pepe, according to blockchain analytics firm Spot on Chain.

So, how did WazirX react and why has it come under fire?

‘Socialized loss’ and the problem therein: WazirX's initial response involved suspending all trading activities to prevent further losses, contacting multiple exchanges to block traced assets, setting up a $23 million bounty programme, collaborating with law enforcement agencies—Indian Computer Emergency Response Team, or CERT-In, and the US Federal Bureau of Investigation—and conducting a thorough investigation of the attack.

However, in critical situations such as this, it is paramount that companies offer as much support as possible to their user base. And this is where WazirX, which maintains accounts and holds balances for approximately a third of all Indian cryptocurrency users, seems to have failed.

The crypto exchange proposed an unorthodox “ socialised loss strategy”—basically distributing the financial losses owing to the cyberattack equitably among all users holding cryptocurrency on the platform. This meant WazirX would hold on to 45% of a user’s crypto assets (not rupee funds, which were not stolen). The 45% of the crypto assets taken would then be converted into USDT or an equivalent token—a stablecoin whose price is pegged to the US dollar and thus more stable. For example, if a user’s account has Rs 100 and crypto worth Rs 20, the Rs 100 will be free to use. But of the Rs 20 in crypto, only Rs 11 (55%) will be unlocked for use, while Rs 9 (45%) will be converted into stable tokens and locked, which means they cannot be accessed.

WazirX also introduced a priority system to distribute whatever funds they potentially recover. First priority access to recovered funds would be given to those who did not want to withdraw their assets. Those who wanted the option of withdrawal would be given their share from recovered proceeds, if any, only after the first group.

Customers and crypto experts were miffed. What WazirX was suggesting would mean that users who made money on the platform would bear the brunt of the company’s own lapses in security. This is in addition to the already existing volatility inherent in cryptocurrency trading.

Even co-founder of rival crypto platform CoinDCX, Sumit Gupta, chimed in, saying that the strategy was not going to go down well and could even hurt other players in the crypto ecosystem in the process. The predominant social media narrative from WazirX’s user base was that the company should have either absorbed the losses, reimbursed users with their own WRX token, or sought external assistance rather than passing the $230 million loss onto customers.

There are several valid criticisms to the way WazirX handled the situation. One, that socialism works both ways: If WazirX wanted to socialize losses, it should, at some point, have also offered to equally distribute profits, including its own. Only then is it truly equitable.

“Everyone is a capitalist till they are in losses, then socialism is the way to go,” an Indian crypto trader who did not wish to be named told The Morning Context.

Two, trading is an opportunistic activity that draws on users’ individual capabilities to take on the right risks or harness resources to make the right calls. Socialism in such a context would be illogical.

Three, ultimately, it is the users who lost simply because they chose this platform. And the lack of a mechanism to handle such situations, in addition to the already volatile crypto space, means they are vulnerable to even greater risks.

“It is amazing that people are still using centralized exchanges after the public failures of MtGox in 2014, FTX in 2022 and others… While WazirX is trying to socialize losses, you are stuck in a bad situation as a user,” another investor who has been active in the cryptocurrency space said on condition of anonymity.

Lastly, it’s almost ridiculous that WazirX co-founder Nischal Shetty has asked other exchanges for help to “relieve his customers' losses”.

In the absence of clear regulatory guidelines for cryptocurrency exchanges in the event of such security breaches occurring, WazirX’s handling of the situation cannot even be faulted. It simply means that in the event of a “force majeure” incident or unforeseeable circumstances, it is crypto investors that will stand to lose because no regulatory body is holding the company accountable. The whole incident will only erode investors’ trust in the ability of exchanges like WazirX to handle such breaches.