Beosin: WazirX’s hack linked to breach in multisig wallet admin signature data

Blockchain security firm Beosin indicated via its X account that the recent $230 million hacking incident at the Indian cryptocurrency exchange WazirX likely occurred due to a breach in the exchange's multisig wallet admin signature data. This breach allowed the attacker to manipulate the wallet's logic contract, executing commands that facilitated the theft of assets. The attacker's address is identified as 0x6eedf92fb92dd68a270c3205e96dccc527728066, while the victim's address is 0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4. Beosin cited several circumstances as evidence for its analysis: 1. The attacker deployed the contract at 0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4 to enable the withdrawal of specified token assets. 2. The attacker obtained signature data from WazirX's multisig wallet and modified its logic contract to interact with a pre-deployed attack contract. 3. The attacker initiated a token withdrawal transaction on WazirX's multisig wallet. Using the proxy pattern mechanism, the wallet contract employed delegatecall to execute functions from the attack contract. According to smart contract developer Oluwatosin Serah, delegatecall is “a low-level function that allows a contract to delegate its call to another contract (borrowing the functionality of another contract) while still preserving its own storage and context.”