About 4.2 million of WazirX’s 16 million users were struck by a massive hack of the cryptocurrency exchange on 18 July that wiped off 40-50% of their crypto balances. Most of those affected users were Indians. But in the month and half since the $230-million hack there has not been any legal or regulatory action in India against the exchange or its owners.
India has taken the route of taxing cryptocurrency without actually regulating it or creating any safeguards for consumers. It has also laid bare the complex holding structures and interlinkages of crypto exchanges in India.
WazirX has offered a $23 million bounty to help it recover the digital assets stolen from one of its wallets. But it has approached the High Court of Singapore, where its parent company Zetai Pte is located, seeking a moratorium on all legal claims against it while it comes up with a restructuring plan.
CoinSwitch, another Indian crypto exchange, has approached Singapore courts to recover its own cyrpto balances that were held in WazirX. Most other victims of the WazirX hack wouldn’t have that luxury.
“I had invested approximately ₹1.4 lakh in WazirX around 3-4 years ago, which grew to ₹2 lakh over time… I think about half my money will come back—whether in 1 year or 10 years I don’t know,” said Ravi Handa, a Jaipur-based investor.
WazirX declined to comment for this report.
Criminal litigation an option for users
WazirX, which held about $570 million in customer balances before the hackers struck, cancelled trades done after 18 July and stopped withdrawals. It thereafter allowed withdrawal of two-thirds of the cash balances held with the exchange in a phased manner. It decided to retain the remaining one-third of the balances to meet legal requirements.
This amount may relate to past seizures by enforcement agencies of cryptocurrency held in trust in WazirX or to regulatory action against the exchange itself. In 2022, the Enforcement Directorate had served a notice under the Foreign Exchange Management Act to WazirX for allowing outward remittance of ₹2,790 crore to unknown wallets.
Nitin Sethi, who has been using WazirX for more than six years, shared his concerns about the platform’s governance and security issues. “It is strange that you hold so much money in one single wallet which got hacked,” he said, adding that WazirX’s centralised approach instead of maintaining multiple wallets to distribute risk has put millions of users’ funds at risk.
WazirX has stated that its safeguards require 5-6 signatories, including a custodian, for its wallets.
Also read | The $230 million WazirX hack: How safe are your cryptocurrencies
View Full Image
WazirX’s Singapore headquarters has also left many users feeling abandoned by both the platform and local regulatory bodies such as India’s Financial Intelligence Unit (FIU), which is yet to issue any clear statements or actions in response to the hacking.
“Indian customers have the option to pursue criminal litigation against WazirX in India, which could potentially assist in the recovery of funds and holding the responsible parties accountable. Criminal proceedings can be more effective in compelling action and securing restitution, especially in cases involving such kind of potential fraud or misconduct,” said Sumit Agrawal, founder, Regstreet Law Advisors, and a former officer with the Securities and Exchange Board of India.
“However, investors must also consider the evolving nature of law and regulation in India’s cryptocurrency sector. Without a comprehensive and established regulatory framework, investors are currently operating at their own risk,” he added.
Sans regulations, the buck stops with the… users
Nikhil Kumar, a co-founder of a startup based in Bengaluru, shared his frustrations on not being able to sell his cryptocurrency holdings in WazirX due to the platform’s decision to halt trading following the 18 July attack.
“I need some money to withdraw from the profits as I also do not know how the markets would change because anyway it is a volatile market,” he explained.
Kumar had invested incryptocurrenciesin 2021 with the intention of using the savings as part of his long-term investment strategy. He finds himself stuck now unable to liquidate his crypto assets when he needs them most. “It would have been really helpful if I could use some part of my savings there, because I had invested my money so that it would be of some use to me in the future.”
Kumar added that unlike banks and financial institutions that take responsibility when something goes wrong, WazirX has left its users to bear the brunt of their losses. “WazirX should take some responsibility and not let the users suffer.”
Also read | Why recovering $230 mn of stolen cryptos will be daunting task for WazirX even with a rich bounty
Ajeet Khurana, founder of Reflexical Pte Ltd, a Singapore-based advisory for startups in the Web3 space, said WazirX’s decision to use “customer funds for legal expenses is unprecedented”.
“There needs to be a lot more disclosure about how much money is being held in which entity—Indian or Singaporean. While the moratorium application in Singapore has revealed a lot of information, there should be similar transparency about the Indian entity too,” said Khurana. “WazirX should consider making significant reparations to make up for the customer’s loss from its own treasury, and from the sale of its equity and other assets.”
For the long term, though, Agrawal of Regstreet Law Advisors said Sebi and the Reserve Bank of India need to jointly step in and regulate the cryptocurrency market to prevent such incidents.
“Until such regulations are in place, the risks associated with digital assets will remain high, making it imperative for investors to be cautious and well-informed.”