The $235 Million WazirX Hack: Recovery Tokens, Not Guaranteed Repayment

1. When the Screen and Payload Diverged

On July 18, 2024, a cyber attack hit one of Indian exchange WazirX's multisig wallets, stealing digital assets the company valued above $230 million. Elliptic's same-day analysis estimated about $235 million across 200-plus assets — $96.7 million of Shiba Inu, $52.6 million of Ether, $11 million of Matic, $7.6 million of Pepe — as the thief swapped tokens for Ether on decentralized services.^[1][2]

The setup was professional-grade, the company said. Operated on Liminal's custody infrastructure since February 2023, the wallet had six signatories — five from WazirX, one from Liminal. A transaction normally needed three WazirX approvals, each signed on Ledger hardware wallets, then Liminal's final sign-off, inside a Gnosis Safe multisig with whitelisted destinations.^[1]

WazirX's preliminary report put the failure in the gap between what signers saw and signed:^[1]

The cyber attack stemmed from a discrepancy between the data displayed on Liminal's interface and the transaction's actual contents.^[1]

— WazirX, Preliminary Report: Cyber Attack on WazirX Multisig Wallet (July 18, 2024)

2. Four Million Creditors, One Balance Sheet

WazirX suspects the payload was replaced to hand the attacker wallet control — a suspicion, not an adjudicated finding. Withdrawals, then trading, were halted — force majeure, the company said. Attribution stayed at the level of analysis: Elliptic's review indicated hackers affiliated with North Korea, and a January 2025 United States–Republic of Korea joint statement attributed the $235 million theft to the DPRK "based on detailed industry analysis."^[1][2][3]

On August 27, 2024, Zettai Pte Ltd, the Singapore-incorporated entity operating WazirX, filed for a moratorium in the Singapore High Court — a statutory pause on lawsuits and winding-up attempts, automatic for 30 days — to build a scheme-of-arrangement restructuring.^[4]

The filing reframed what users held: aside from law-enforcement deposits held on trust, users were unsecured creditors — owed the value of their balances, not owners of specific coins — and the company counted over 4.4 million of them. A scheme of arrangement is plainly a court-supervised deal: creditors vote, a judge sanctions, the result binds everyone. Two shadows hung over the math: an unresolved ownership dispute with Binance, and liabilities the company said now exceeded assets.^[4][10]

The design principle was strict equality: losses allocated pro-rata across equally ranking unsecured creditors, each receiving token assets proportionate to claim. Singapore law set a double bar — a majority by number and at least 75% by value under Section 210(3AB) of the Companies Act — then court sanction.^[4][5]

3. Half a Billion Dollars, Rebalanced

Zettai's official example put total claims at $546 million as of July 18, 2024, 1:00 PM IST, of which roughly $235 million was stolen. The scheme split the rest into two buckets: rebalanced Net Liquid Platform Assets for near-term distribution, and Illiquid and Stolen Assets whose recovery would take years.^[7][2][4]

In January 2025 the company rebalanced the liquid pool and said creditors would receive approximately 85.25% in fiat-equivalent recovery, within 0.5% variance — paid in tokens, not cash, within 10 business days of effect, thinly traded tokens partly settled in USDT. Deposits made after the attack were excluded and returned in full. Its disclaimer mattered: figures were "indicative only," never a committed amount.^[6]

The remainder of every claim became Recovery Tokens — one billion issued pro-rata, each allocation equal to that creditor's share of the $546 million claim pool. By the company's definition, the tokens represent each creditor's share of the Illiquid and Stolen Assets: not money, not redeemable on demand. Payouts arrive as buybacks — every three months the company tallies realized recoveries, and once at least $10 million in unencumbered value has accrued, a portion goes to purchasing tokens from holders; anything less rolls forward.^[7][4]

A profit-sharing tap supplemented the engine: 100% of company profits to creditors until $30 million of scheme cost reserves were recouped, then 50% for 36 months or until every Recovery Token was bought back — the company's design, sanctioned into law, guaranteeing no total.^[4]

4. Yes, No, Yes Again

Voting ran March 19–28, 2025 on Kroll's platform. Per company figures verified by an independent assessor from Alvarez & Marsal, 141,476 creditors holding $195.65 million in approved claims voted — 93.1% by count and 94.6% by value said yes, clearing the statutory bar.^[5]

Then the plan hit the bench. On June 4, 2025, the Singapore High Court declined to sanction the scheme in HC/SUM 940/2025; Cointelegraph reported the concern was how Recovery Tokens would fare under Singapore's incoming framework for digital token service providers. The Hindu also reported the refusal.^[8][11]

The fix was structural: after Singapore's Financial Services and Markets Act 2022 licensing provisions were set to take effect on June 30, 2025, the scheme was amended so Zanmai Labs, Zettai's India-incorporated subsidiary, would distribute tokens and manage operations. The court then set aside the June 4 order and allowed a revote, the company said. From July 30 to August 6, 2025, 149,559 creditors holding $206.89 million in claims voted; 95.7% by count and 94.6% by value approved, per the company.^[4][8]

Founder Nischal Shetty framed the revote as vindication:^[8]

A second round of voting having such strong numbers is a testament to our approach towards the restructuring which has been fair, transparent, and the quickest option for users to recover funds.^[8]

— Nischal Shetty, founder of WazirX (August 2025 press release, as reported by The Hindu)

5. Sanctioned, Effective — and Still Not Repaid in Full

On October 13, 2025, Zettai announced that the Hon'ble High Court of Singapore had sanctioned the amended scheme, with modification; Cointelegraph reported the approval as clearing the path to repay more than 150,000 users. The order was lodged with Singapore's corporate registry, ACRA, on October 15, and the Section 210 scheme took effect that day.^[9][11][10]

Founder Nischal Shetty cast the sanction as a milestone of pace:^[9]

The sanction represents a key milestone in WazirX's journey since it marks one of the fastest restructurings in the global crypto industry, despite suffering one of the biggest cyberattacks in the history of this space.^[9]

— Nischal Shetty, founder of WazirX (press release, October 13, 2025)

Machinery moved on schedule: the platform restarted under new BitGo custody. Decrypt reported the October 24 reopening — zero-fee trading, a quarter of tokens re-enabled daily, and INR withdrawals already live — for 6.6 million locked-out users, while Recovery Token issuance was still being prepared under the scheme.^[9][12]

What remains, no order can fix. The first distribution was an estimated 85.25% of claim value; an outside exchange chief told Decrypt "the 15% shortfall remains a concern," users reported receiving less than expected, and the Delhi High Court ordered Zettai to produce its Binance acquisition agreement. Recovery Tokens are still not liquid money — trading may come only subject to legal and regulatory requirements, and buybacks depend on recoveries and profits no one can promise. The stolen assets remain, in the scheme's own accounting, an unliquid claim on the future.^{[12][6][7][9]}