The automobile spare parts dealer in Patna got worried when he glanced at the alerts on his phone on July 18. News portals were reporting that India’s cryptocurrency exchange WazirX had been hacked. At first, he thought that meant a “technical glitch” and things would get back to normal. The full extent of his misfortune was yet to be revealed.

“My cousin told me some Rs 2,000 crore had been stolen from the company,” said the 32-year-old man. “I immediately rushed to withdraw my Rs 7 lakh investment on WazirX but it was too late--no transactions were allowed.”

The prospect of never being able to get his money back has caused sleeplessness, anxiety, emotional distress and setbacks in business. At home, he pretends nothing has happened. “My wife thinks I do some stock market trade,” he said. “She doesn’t understand crypto stuff--she thinks we are rich.”

He dwells on what might have been.

“Every day, I take a pen and paper (to calculate) and tell my co-worker that today the value of my crypto would have been Rs 25 lakh,” he said. “(Auto) agency guys would have given us so much business on such credit.”

He’s not alone.

About 15 million users of WazirX were victims of one of the largest cyberattacks on a cryptocurrency exchange in July, leading to the theft of investor holdings worth $235 million or nearly half of the platform's estimated reserves. Since then, the remaining funds on the platform have been frozen and trading has been halted.

ET spoke to about a dozen people who had invested between Rs 30,000 and Rs 1.5 crore on the platform. Many recounted tales of financial distress--individuals driven into debt, some having to flee their villages and others grappling with suicidal thoughts.

Where is the money?

Somewhere the thief (or thieves) who masterminded this heist is watching the tokens swell in value in the ongoing crypto bull run. As per an analysis of Lookonchain data, that $235 million will now be valued at about $330 million.

Crypto prices have skyrocketed in the past month following the victory of Donald Trump—a sceptic-turned-champion—in the US elections. In the past month, crypto market cap has grown from $2.4 trillion to $3.7 trillion, surpassing that of companies like Apple and Nvidia.

Netherlands-based blockchain intelligence firm Crystal Intelligence recently said that the WazirX thief has almost finished laundering the stolen funds via TornadoCash. Only $6 million of Ether (ETH) remains traceable. TornadoCash is an open source, non-custodial, fully decentralised cryptocurrency platform that shuffles crypto tokens, making it difficult to track the source of funds and recover any stolen money.

The rebalancing

Owned by Singapore-based Zettai Pte Ltd, WazirX was once the largest Indian exchange, holding over $535 million in investor assets. Investors have been incensed at the manner in which the crisis has been handled, with much of the anger directed at cofounder and CEO Nischal Shetty.

To be sure, on November 6, WazirX announced that it plans to return 52% of total creditor claims through remaining liquid assets ($284 million) while the remaining 48% will be distributed over the coming years from future profits and recoveries of the stolen assets. It must be noted that the unstolen liquid funds are today valued at $577 million.

But WazirX has set a cut-off of 1 pm India time on July 18 to determine claim value. This has enraged investors as their holdings would have surged in value since then. For instance, when WazirX was drained, Shiba Inu (SHIB), was the largest category token stolen by value. Since then, this has grown to $173 million from $102 million. Similarly, Pepe’s value has grown from $7.6 million to $14 million.

It should be noted that Bitcoin (BTC) has been the biggest gainer, soaring 60% in value since the hack. But BTC was not stolen by the hacker because the underlying blockhain’s design makes it hard to compromise. Therefore, BTC investors on WazirX are fuming over why they must pare their gains due to the company’s lack of security.

Also Read: Crypto’s legal tangles seem as mystifying as digital asset itself

“If the platform undergoes restructuring or liquidation, all users’ claims are treated equally, with available assets distributed proportionally,” a WazirX spokesperson told ET.

Zettai is undergoing a restructuring programme under the Singapore High Court and the scheme requires approval by a minimum 75% of creditors.

WazirX and its third-party custody solutions partner Liminal Custody are at loggerheads, accusing each other over vulnerabilities in systems that were exploited by the hacker. WazirX blamed Liminal and terminated its contract with the custody and wallet infrastructure platform. Meanwhile, through an independent audit, Liminal showed that it’s merely a software provider and did not have any control over WazirX’s funds.

Pressing questions

Since the incident, serious concerns have been raised about WazirX’s conduct by the investor community, crypto experts and blockchain security firms.

“The two most alarming questions, which Nischal Shetty has consistently failed to address are, one--why, for all these years, were investors not informed that the ownership of the company was disputed between WazirX and Binance?” said Romy Johnson, a leading representative of the WazirX investor community. “Second—and perhaps more troubling—why did WazirX store $235 million worth of tokens in a single wallet while spreading $300 million across 240,000 wallets? Was this an open invitation for hackers to strike?”

WazirX said handling thousands of wallets is “normal” for large exchanges.

Also Read: WazirX suffers security breach; $235 million worth of funds moved

In 2019, Binance, the world’s largest crypto exchange, announced that it had acquired WazirX. However, Binance now claims the deal never materialised due to Zettai’s failure to meet its obligations. This dispute is currently being litigated in a Singapore court, leaving investors in a lurch.

Johnson questioned why WazirX had failed to maintain surplus reserves to handle crises.

“The hack amount is too huge and large exchanges cannot maintain such a high surplus ratio,” WazirX said in response to this.

Investor Johnson also sought clarification on Shetty’s funds and queried the cut-off date.

“What happened to Nischal Shetty’s personal wealth or the company’s past profits?” he said. “What is the rationale behind selecting July 18 as the cut-off date for liabilities?”

Johnson also asked why investors’ ₹100 crore was being used as a crisis management fund.

“The lack of transparency and accountability is deeply troubling,” Johnson added, highlighting how these unresolved issues have undermined confidence.

The investor community is demanding immediate action and clearer communication to safeguard the interests of those affected.

Legal recourse

Scores of first information reports (FIRs), lawsuits, petitions to the National Investigation Agency (NIA), letters to the finance ministry, CERT-In and hundreds of daily social media posts appear to have fallen on deaf ears. Although crypto isn’t illegal, it isn’t recognised as an investment class under Indian law. But crypto trading income is taxed under the Income Tax Act. CERT-In is the Indian Computer Emergency Response Team, the nodal agency on cyber security.

Last month, the Delhi Police special cell arrested SK Masud Alam of West Bengal, accusing him of selling a fake login to the thief.

“Our police départements are unequipped to investigate such a sophisticated cybercrime… hence this is just scratching the surface,” said a lead lawyer in the case. “Neither can law enforce its weight because India does not recognise crypto as a legitimate investment class. It is only taxed as a virtual digital asset under the Income Tax Act. Only CERT-In is required to investigate the case as a cyberattack under the Information Technology Act.”

Also Read: WazirX parent looking for ‘white knights’ to rescue crypto exchange