# WazirX: make custody responsibilities testable before an incident

Canonical: https://www.web3sec.news/blog/wazirx-custody-responsibility
Author: Raiders (https://www.web3sec.news/about)
Format: postmortem
Topic: Web3
Published: 2026-11-08
Updated: 2026-11-08
Incident date: 2024-07-18

The July 2024 wallet theft illustrates the operational consequences of unclear verification and response responsibilities.

### Diagram: Verify transaction meaning outside the interface.

A trusted-looking signing screen is not proof of the action being signed.

![A transaction proposal must be independently decoded and compared with intended chain, destination, value, function and permissions before the signer authorizes it on a trusted device. The signing interface alone is insufficient evidence.](https://www.web3sec.news/diagrams/signing-verification.svg)

[Full-size SVG](https://www.web3sec.news/diagrams/signing-verification.svg) · [PNG download](https://www.web3sec.news/diagrams/signing-verification.png)

Original explanatory control model; not a reconstruction of private incident evidence.

## Established event, disputed explanations

WazirX reported that a multisig wallet was attacked on 18 July 2024, with more than $230 million in digital assets stolen. Its published statements discuss a wallet accessed through Liminal infrastructure and describe a mismatch between expected transaction behavior and the transaction that was approved.

Liminal published a different account of responsibility, stating its platform remained secure and pointing to a customer-level compromise. These party statements should not be collapsed into a definitive, independently proven root cause. This analysis does not resolve that dispute or describe current customer recovery outcomes.

## Turn contractual assurances into observable controls

Our analysis: an organization needs evidence of what a custody policy actually enforces. For each signing path, document who constructs the transaction, who decodes it, where allowlists are enforced, which operations bypass ordinary transfer rules and who can change those policies.

In a non-production environment, test an unexpected destination, an implementation change and an approval request outside normal working patterns. Record whether the restriction is enforced by a contract, a signing service or a user interface. Those controls have different trust assumptions and failure modes.

## Prepare for a service interruption

Wallet compromise can become a customer operations problem immediately. Prepare a decision tree for deposits, withdrawals and trading that accounts for incomplete information. A public status message should identify the affected scope, action being taken and next update time without presenting guesses as conclusions.

Maintain an evidence-sharing process with service providers before an incident. Agree on access to logs, retention, escalation contacts and preservation steps. Test those arrangements during a joint exercise rather than discovering their limits while funds are moving.

## Controls to take away

- Test policy enforcement at the actual signing boundary.
- Agree on evidence access and provider escalation in advance.
- Keep disputed claims clearly attributed in incident communications.

## Sources & further reading

- [WazirX: incident overview and response measures](https://wazirx.com/blog/important-update-cyber-attack-incident-and-measures-to-protect-your-assets/)
- [Liminal: published response, 29 July 2024](https://www.liminalcustody.com/blog/liminal-remains-secure-amidst-sophisticated-attack/)

Incident facts are attributed to the linked reports. Recommendations are Web3Sec's analysis.

[Research methodology](https://www.web3sec.news/methodology) · [Editorial policy](https://www.web3sec.news/editorial-policy) · [Send a correction](https://www.web3sec.news/contact)