Indian cryptocurrency exchange WazirX on Saturday announced controversial plans to “share” the $230 million loss from a recent security breach with all of its customers, a move that has sent shock waves through the local crypto community.
The Mumbai-based company suspended all trading activity on its platform last week following a cyber attack that compromised nearly half of its reserves, but has outlined a strategy to resume operations within a week or so while implementing a “fair and transparent loss socialization strategy” to “equitablely” distribute the impact among its user base.
WazirX will “rebalance” customer portfolios on its platform, returning only 55% of their holdings and locking the remaining 45% in USDT-equivalent tokens. This will also affect customers whose tokens were not directly affected by the breach, with the company stating that “users with 100% of their tokens in the 'non-stolen' category will have 55% of their tokens returned.”
According to blockchain data analysis provided by third-party explorer Lookchain, the security breach resulted in the theft of over 200 cryptocurrencies, with the majority of the losses concentrated in a few popular tokens, including Shiba Inu (SHIB), Ethereum, Polygon's MATIC, and meme cryptocurrency Pepe.
According to WazirX, the cyber attack, which occurred on July 18, exploited discrepancies between the data displayed on the interface of multi-signature wallet provider Liminal and the actual transaction content.
WazirX will now offer users two options. Option A allows customers to trade and hold crypto assets and receives priority in recovery efforts, but limits withdrawals. Option B allows trading and withdrawals, but receives lower priority in recovery efforts. Users can switch between these options, subject to certain conditions.
“Option B allows you to trade or withdraw your assets, however, recovery efforts will be focused on those who selected Option A first. You can switch to Option A at any time before making any trades or withdrawals,” WazirX added.
WazirX founder Nischal Shetty confirmed in a one-sided community conference call on Friday evening that the company did not insure its customers' funds because such an option was not practical, and warned that recovery efforts are uncertain and could take years.
“WazirX actually manages crypto assets held for its users, meaning it is not merely acting as an exchange or custodian, but actually accessing users' wallets, taking their crypto assets and giving them to others. It cannot claim to be just an exchange,” said Nikhil Pahwa, policy advocate and editor at Medianama.
Many of Wazir X's customers asked the company on Saturday why it didn't use its profit reserves to fully compensate customers, or at least mitigate their losses.