WazirX was attacked due to the leakage of administrator's private key

BlockBeats news: On July 18, Beosin Alert detected that the Indian trading platform WazirX was attacked. The attacker obtained the signature data of the multi-signature wallet administrator of the trading platform, modified the logical contract of the wallet, and made the wallet execute the wrong logic to steal assets.

Attacker address: 0x6eedf92fb92dd68a270c3205e96dccc527728066;

Attacked address: 0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4.

Based on the attacker’s attack behavior, it is speculated that the cause is the leakage of the administrator’s private key of the multi-signature wallet. Beosin briefly analyzes the cause of the attack as follows:

1. The attacker deployed the attack contract: 0x27fd43babfbe83a81d14665b1a6fb8030a60c9b4. The function of this contract is to extract the token assets specified by this contract

2. The attacker obtained the signature data of the WazirX multi-signature wallet administrator and modified the wallet’s logical contract to the deployed attack contract. The corresponding transaction is: https://etherscan.io/tx/0x48164d3adbab78c2cb9876f6e17f88e321097fcd14cadd57556866e4ef3e185d3. The attacker submitted a token withdrawal transaction to the WazirX multi-signature wallet. Due to the proxy mode mechanism, the wallet contract will use delegatecall to call the relevant functions of the attack contract and transfer the wallet tokens.