Security Incident on FTX and WazirX , Learnings and Precautions

FTX Security Incident

Overview:

FTX, a major cryptocurrency exchange, experienced a significant security breach in November 2022, resulting in the loss of approximately $477 million in digital assets.

Incident Details:

1. Discovery and Initial Response:

- The breach was discovered on November 11, 2022, when unusual activity was detected in FTX's wallets.

- FTX immediately moved the remaining assets to cold storage to mitigate further loss.

- The exchange announced the breach and began working with cybersecurity firms and law enforcement agencies.

2. Nature of the Breach:

- The breach involved compromised private keys, which allowed the attacker to drain funds from multiple wallets.

- The attackers used sophisticated techniques to cover their tracks, making it challenging to trace the stolen assets.

3. Impact and Response:

- The stolen assets were valued at around $477 million.

- FTX pledged to compensate affected users and enhance its security measures.

- The incident led to increased regulatory scrutiny and legal actions against FTX

4. Precautions to Prevent the Breach:

- Enhanced Key Management: Regularly update and rotate private keys, and ensure that keys are stored in secure environments.

- Multi-Factor Authentication (MFA): Implement MFA for all sensitive operations, including access to private keys and transaction approvals.

- Continuous Monitoring: Deploy real-time monitoring systems to detect and respond to suspicious activities promptly.

- Regular Audits: Conduct frequent security audits and penetration tests to identify and mitigate vulnerabilities.

---

WazirX Security Incident

Overview:

WazirX, India’s largest cryptocurrency exchange, suffered a major security breach in July 2024, resulting in the theft of $234 million worth of digital assets from one of its multisig wallets.

Incident Details:

1. Discovery and Initial Response:

- The breach was discovered on July 18, 2024, when unauthorized transactions were detected from a multisig wallet managed by Liminal.

- WazirX paused all withdrawals and deposits to secure remaining assets and announced the breach on social media

2. Nature of the Breach:

- The multisig wallet had six signatories: five from WazirX and one from Liminal.

- The attack exploited a discrepancy between the transaction details shown on Liminal’s interface and the actual signed transaction, allowing the attacker to gain control of the wallet

3. Impact and Response:

- The stolen assets represented nearly half of WazirX's total holdings, as reported in their June 2024 proof of reserves.

- WazirX collaborated with law enforcement agencies, other exchanges, and cybersecurity experts to track and recover the stolen funds.

- The exchange implemented a bounty program to incentivize information leading to the recovery of the assets.

4. Precautions to Prevent the Breach:

- Enhanced Interface Security: Ensure that the interface accurately reflects the transaction details to prevent discrepancies.

- Stronger Multisig Protocols: Implement more stringent multisig protocols with additional verification steps.

- Whitelisting Policies: Enhance whitelisting policies to include more rigorous checks and balances.

- Regular Security Reviews: Conduct frequent security reviews and updates to the multisig wallet infrastructure.

---

Comparison and Key Learnings:

1. Nature of Attacks:

- Both FTX and WazirX breaches involved compromised private keys and unauthorized transactions.

- FTX targeted multiple wallets, while WazirX focused on a single multisig wallet.

2. Response and Mitigation:

- Both exchanges moved remaining assets to cold storage and involved cybersecurity firms and law enforcement.

- They communicated transparently with users and the public about the breaches and steps being taken.

3. Regulatory and Legal Implications:

- Both incidents led to increased regulatory scrutiny and legal actions aimed at improving the security standards of cryptocurrency exchanges.

4. Precautionary Measures:

- Regularly update and rotate private keys, implement MFA, deploy real-time monitoring systems, and conduct frequent security audits.

- For multisig wallets, ensure accurate interface reflections of transaction details, implement more stringent verification protocols, and enhance whitelisting policies.

Sources:

- [Business Standard on WazirX breach](https://www.business-standard.com/article/technology/wazirx-suffers-security-breach-digital-assets-worth-234-million-swindled-124071801135_1.html)

- [WazirX Blog on Cyber Attack](https://wazirx.com/blog)

- [CoinTelegraph on FTX breach](https://cointelegraph.com/news/ftx-hacked-477m-in-suspected-crypto-theft)

- [Decrypt on FTX breach](https://decrypt.co/113742/ftx-hack-477-million-stolen)