Loading story…
A Singapore court has allowed Zettai Pte Ltd, the parent entity tied to crypto exchange WazirX, to hold an online creditors’ meeting on a restructuring plan aimed at recovering more than $230 million stolen in a July 2024 cyberattack. The High Court also granted a 16-week moratorium and approved changes to streamline the voting process, while saying there was no proper evidence for claims that Zettai had orchestrated the theft. WazirX said the proposed scheme would reorganize liabilities, issue recovery tokens, and potentially restart the platform with new products including a decentralized exchange; if creditors and the court approve it, initial payouts could begin within 10 business days after the plan takes effect.
The recovery effort follows a July 18 breach of a multi-signature wallet that forced WazirX to halt rupee and crypto withdrawals and later revealed losses affecting roughly 45% of exchange assets. WazirX and custody provider Liminal publicly disputed responsibility for the exploit, while users criticized the exchange’s transparency, withdrawal freezes, and an earlier "socialised loss" proposal that would have returned only 55% of tokens immediately. The company has reported the incident to police, launched bounty efforts, said it had frozen an initial $3 million tranche of stolen assets, and disclosed liquid assets of 566.38 million USDT against 546.47 million USDT in claims as legal and customer pressure continues to mount.
Track how attackers are adapting to this technology.
9 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-09, the Singapore High Court authorized Zettai to convene an online creditors' meeting on its restructuring scheme, granted a 16-week moratorium, and said there was no proper evidence supporting claims that Zettai had orchestrated the theft.
As of 2024-12-05, the company said it held liquid assets of 566.38 million USDT against total claims of 546.47 million USDT, providing an updated snapshot of its post-hack financial position.
Earlier in December 2024, WazirX reported freezing an initial tranche of stolen assets worth $3 million as part of efforts to recover funds taken in the July hack.
By early September 2024, CoinSwitch said its funds were trapped on WazirX and that it would pursue legal action, adding to mounting legal pressure on the exchange after the breach.
Following the July 18 wallet exploit, WazirX and custody provider Liminal blamed each other for security failures tied to the compromised multi-signature wallet. The dispute unfolded as customers criticized WazirX over transparency and frozen withdrawals.
On 2024-08-27, WazirX operating entity Zettai filed for a moratorium in the High Court of Singapore to support a Scheme of Arrangement aimed at restructuring liabilities and managing recovery after the hack.
In the aftermath of the hack, WazirX notified Indian police, launched bounty programs to trace stolen assets, and introduced a 'socialised loss strategy' under which users would initially receive 55% of their tokens while the remainder would be locked or otherwise managed for recovery.
By 2024-07-29, WazirX said the July 18 cyberattack had affected about 45% of its crypto assets and resulted in the theft of more than $230 million from one wallet. The exchange said it had held roughly $500 million in digital assets before the incident.
On 2024-07-18, WazirX disclosed a security breach affecting one of its multi-signature wallets and temporarily paused both Indian Rupee and cryptocurrency withdrawals while it investigated the incident.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
economictimes.indiatimes.com
Open sourcethehindu.com
Open sourcethehindu.com
Open sourceindianexpress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Roger Ver, a prominent early bitcoin investor known as "Bitcoin Jesus," agreed to pay nearly $50 million to the U.S. Department of Justice to settle federal tax charges related to his cryptocurrency holdings. Ver entered into a deferred prosecution agreement after admitting that he willfully omitted a significant portion of his bitcoin assets when filing expatriation-related tax returns in 2016, which reduced his tax liability by over $16.8 million. The settlement included back taxes, penalties, and interest, and following the payment, prosecutors moved to dismiss the indictment against him. This case highlights the increasing scrutiny by U.S. authorities on cryptocurrency investors who attempt to evade taxes by renouncing citizenship or failing to report digital assets. In a separate incident, a trader suffered a loss of approximately $21 million on the decentralized exchange Hyperliquid due to a private key compromise. The attacker was able to access the trader's wallet and transfer the funds, underscoring the persistent risks associated with private key management in decentralized finance (DeFi) platforms. The Hyperliquid incident demonstrates the ongoing threat of targeted attacks against high-value cryptocurrency accounts, where a single compromised key can result in substantial financial losses. Additionally, the Ethereum Foundation and Keyring launched a fund to support the legal defense of Tornado Cash developers, reflecting the broader legal and regulatory challenges facing the crypto ecosystem. Indian authorities initiated an investigation into Binance traders for alleged crypto tax evasion, signaling a global trend of increased regulatory enforcement in the digital asset space. Hackers executed a $32.5 million dump, marking the largest crypto liquidation event of the week, which had significant market impact and raised concerns about the security of large-scale digital asset holdings. New York City established the nation's first mayoral office dedicated to digital assets and blockchain, indicating growing institutional interest in the sector. These incidents collectively illustrate the multifaceted risks in the cryptocurrency landscape, including legal, regulatory, and technical threats. The convergence of high-profile tax settlements, major thefts, and regulatory actions highlights the need for robust compliance and security measures among digital asset holders and service providers. The events also emphasize the importance of secure key management practices and the potential consequences of lapses in operational security. As the digital asset market matures, both individual investors and organizations must remain vigilant against evolving threats and regulatory developments. The week's developments serve as a reminder that the intersection of technology, finance, and law in the crypto space is increasingly complex and fraught with risk. Ongoing education, proactive risk management, and engagement with legal and regulatory frameworks are essential for mitigating exposure in this rapidly changing environment.
Jul 12, 2026
Bybit said attackers stole about **$1.5 billion in Ethereum** after taking control of one of the exchange’s wallets during a routine transfer from a cold wallet to a warm wallet, making the breach one of the largest digital thefts on record. The Dubai-based exchange said customer assets remained fully backed and pledged to reimburse affected users even if the cryptocurrency is not recovered, while the incident triggered more than **350,000 withdrawal requests** and briefly pushed Ethereum’s price down by nearly **4%**. Blockchain investigators at TRM Labs said the stolen funds came from one of Bybit’s offline cold wallets and assessed with **high confidence** that **North Korean hackers** were responsible, citing substantial overlaps between attacker-controlled addresses and wallets tied to earlier North Korean thefts. TRM tagged the compromised addresses under **`Bybit Exploiter Feb 2025`** and tracked the assets in real time, while Bybit offered a **10% bounty** to cybersecurity and crypto-analytics experts who can help trace and recover the stolen funds.
Aug 15, 2026
Grinex, a Kyrgyzstan-based cryptocurrency exchange tied by investigators to the sanctioned Russian platform Garantex, suspended operations after attackers stole roughly **$13.7 million to $15 million** from user wallets. The exchange alleged the intrusion was carried out by actors linked to Western intelligence services and said it had filed a criminal complaint, but no public technical evidence was provided to support that attribution. Reporting says the stolen assets belonged largely to Russian users, and the incident disrupted a platform associated with crypto-ruble activity, including the ruble-backed stablecoin **`A7A5`**. Blockchain analysis from TRM Labs and Elliptic found the stolen funds were moved across **TRON** and **Ethereum**, with large amounts of **USDT on TRON** swapped into **TRX** through **SunSwap** before being consolidated. TRM said it identified about **70 addresses** linked to the theft, exceeding the **54** publicly disclosed by Grinex, and assessed that Kyrgyzstan-based **TokenSpot** was likely compromised in the same operation after two of its addresses sent funds to the same consolidation wallet and the exchange suffered an outage. Investigators said both exchanges are part of a broader Russian sanctions-evasion ecosystem connected to **Garantex**, **Grinex**, **A7**, and **`A7A5`**.
Jun 29, 2026