In July 2024, hackers drained about $230 million — roughly ₹2,200 crore at today’s rate — from a crypto exchange’s wallet using a signing key that belonged not to the exchange, but to its custody vendor. That vendor was Liminal, a four-year-old Singapore-headquartered custody and wallet-infrastructure company built by engineers who had spent years protecting exactly this kind of wallet at one of India’s largest crypto exchanges.
Two months later, an audit Liminal itself commissioned cleared its systems of technical fault. An earlier report on the same breach had pointed the other way. Both conclusions are still cited today, by different people, for different arguments — which is the real story here: what happens to an invisible infrastructure company when the one moment the public notices it is the moment something goes wrong.
Quick facts
| Company | Liminal (Liminal Custody Solutions) |
| Founded | 2021, Singapore (April 2021, per Liminal’s company profile on Startup Intros) |
| Founder(s) | Mahin Gupta, Founder and CEO — earlier founded Buysellbitco.in (2012) and co-founded ZebPay |
| Businesses | Institutional digital asset custody, MPC/multisig wallet infrastructure, institutional staking, stablecoin liquidity (Liminal Prime), whitelabel custody software |
| Latest FY revenue | Not publicly disclosed — Liminal is a private company and does not publish audited financials (CB Insights, September 2026) |
| Latest FY profit/loss | Not publicly disclosed |
| Listed | Private — not listed on any exchange |
| Market value / last valuation | CB Insights estimates roughly $50 million (~₹480 crore) as of the May 2022 seed round — a figure Liminal has not confirmed publicly |
| Key shareholders / CEO | Mahin Gupta (Founder & CEO); disclosed backers include Elevation Capital, CoinDCX, Hashed, Better Capital and Cadenza Ventures |
What they do
Liminal builds the plumbing that crypto exchanges, OTC desks, Web3 projects, hedge funds and family offices use to hold and move digital assets without a single person ever having sole control of the keys. Its core product combines multi-party computation (MPC) and multi-signature wallet technology so that moving funds requires several independent approvals — some from the client, and in many deployments, one from Liminal itself, which checks a transaction against the client’s own policies before it is allowed to execute. Around that core, Liminal sells institutional custody, institutional staking, a stablecoin liquidity product called Liminal Prime, a policy-enforcement layer called Firewall, and whitelabel software that lets other platforms offer custody under their own brand (per Liminal’s own product pages, accessed September 2026). It is not a consumer wallet app; it is business-to-business infrastructure that institutional crypto businesses use because building bank-grade key management in-house is slow and expensive.
The origin
The founding insight came from inside the problem, not outside it. Mahin Gupta had already lived through two cycles of Indian crypto infrastructure before starting Liminal: he launched Buysellbitco.in in 2012, one of India’s earliest bitcoin businesses, and later co-founded ZebPay, which grew into one of the country’s largest crypto exchanges (per Liminal’s “About” page and its company profile on Startup Intros, both accessed September 2026). Running wallet operations at an exchange processing billions of dollars in volume meant living daily with the operational pain of manual key management — the very thing that eventually decides whether an exchange gets hacked. Liminal was spun out in 2021 as a bet that this pain was a sellable product in its own right: rather than every exchange or Web3 treasury rebuilding the same custody stack badly, Liminal would build it once, certify it, and license it to everyone else.
The struggle years
Liminal’s most public struggle did not creep up gradually — it arrived as a single event, and its consequences unfolded over more than a year. On 18 July 2024, attackers compromised the multisig wallet of WazirX, one of India’s largest crypto exchanges and, at the time, one of Liminal’s marquee clients. The wallet needed four of six signers to approve a transaction: five keys belonged to WazirX, one to Liminal. The attackers did not have to break the multisig rule to win — they got three WazirX signers and the one Liminal signer to approve what looked like a routine transaction but was actually a malicious upgrade to the wallet’s underlying smart contract, handing them full control (per the Wikipedia summary of the incident and Halborn’s technical explainer, both accessed September 2026). Roughly $230–235 million in assets was gone within minutes.
The second, quieter setback followed within a month. On 14 August 2024, WazirX announced it was ending its custody relationship with Liminal entirely and moving remaining funds to new multisig wallets, according to CoinDesk’s reporting that day. It was not an amicable parting: WazirX said publicly that while it believed its own systems were uncompromised, “the same cannot be said for the custodian’s interface post the July 18th incident,” and Liminal countered that WazirX’s clients always had full control of their wallets regardless of Liminal’s involvement (CoinDesk, August 2024). For an infrastructure company whose entire pitch rests on being unremarkable and trustworthy, losing its most visible Indian client in public, with both sides blaming each other, was as close to a near-death moment as a B2B security vendor gets without going out of business.
The turning point
The turning point was less the hack itself than the fight over who caused it. A Mandiant report dated 14 August 2024 pointed to the possibility that the breach traced back to Liminal’s custody environment rather than WazirX’s own infrastructure. Liminal disputed this and commissioned an independent review from Grant Thornton, which reported on 9 September 2024 that it found no evidence Liminal’s frontend or backend infrastructure had been compromised, and that the malicious transaction did not originate from Liminal’s systems — a conclusion covered independently by crypto.news, Invezz, Bitget News and CryptoRank that same week. Two credible-sounding reports, weeks apart, reached opposite implied conclusions about the same $230 million event. Before the incident, Liminal was a growing but low-profile custody vendor; after it, “was Liminal at fault” became a live, contested question that a technical audit could narrow but not fully settle in the public’s mind — the numbers on one side were a lost flagship client and a multi-outlet news cycle questioning its core product; on the other, an audit finding of no compromise that Liminal has since used to argue its case.
The money behind it
Liminal has raised modestly by crypto-infrastructure standards, and it has never disclosed a fresh valuation since the amount became public.
- Seed round, announced 17 November 2023: $4.7 million (~₹45 crore), led by Elevation Capital, per Liminal’s own blog post and corroborated independently by Dark Reading the same month.
- Named backers: Elevation Capital (lead), LD Capital, Nexus Venture Partners, CoinDCX, Hashed, Cadenza Ventures, Better Capital and Sparrow Capital, with angel participation from Andreas Antonopoulos, Balaji Srinivasan, Sandeep Nailwal (Polygon co-founder) and Jaynti Kanani (Liminal company blog, November 2023).
- What each backer changed: CoinDCX and Hashed brought exchange-side credibility with the same institutional clients Liminal sells to; Sandeep Nailwal’s and Balaji Srinivasan’s angel checks lent Web3-infrastructure legitimacy; Elevation Capital, as lead, anchored the round and is described by Liminal as its primary institutional backer.
- Total disclosed funding: $4.7 million in named rounds. CB Insights separately lists earlier undisclosed seed tranches from May 2022 and January 2023 plus a small $0.07 million follow-on in April 2024, putting its own tracked total at $4.82 million — the amounts of those earlier tranches were never made public, so the $4.7 million figure is the only round with a disclosed size and named lead investor.
- Latest reported valuation: ~$50 million (~₹480 crore) as of the May 2022 seed, per CB Insights — unconfirmed by the company and not updated publicly since.
How it makes money
Liminal does not publish its pricing, fee structure or take rate, so what follows is drawn from its own description of its products rather than confirmed unit economics.
- Custody and wallet infrastructure: enterprise clients pay to run their asset custody on Liminal’s MPC/multisig stack rather than build it themselves — the core, undisclosed-fee product line (Liminal product pages, accessed September 2026).
- Institutional staking: Liminal lets clients stake proof-of-stake assets held in its custody, a line of business that typically earns infrastructure providers a cut of staking rewards, though Liminal does not publish its share.
- Liminal Prime: a stablecoin liquidity product aimed at exchanges and trading desks — the kind of product that usually monetises through spreads or liquidity fees rather than flat subscriptions.
- Whitelabel custody: other platforms license Liminal’s backend to offer custody under their own brand, a software-licensing revenue line distinct from direct custody fees.
- Compliance tooling (Firewall, Travel Rule, KYT/AML): sold as bundled features that increase the value of the core custody contract rather than as standalone products.
- The part people get wrong: Liminal is not a wallet retail crypto users interact with directly — it is invisible infrastructure sitting behind the exchange or platform a retail user does use, which is exactly why almost nobody outside the industry had heard of it until WazirX’s users started asking where their funds were.
The numbers
Liminal is private and does not disclose revenue or profit and loss for any year — CB Insights’ financial profile for the company shows no reported figures, and no audited filing was found in the course of this research. The only scale metric Liminal discloses on a recurring basis is the on-chain transaction volume it processes for clients, which the company has used in its own press releases to show growth:
| Year / period | On-chain transaction volume processed | Source |
| 2022 (full year) | $1.4 billion (~₹13,440 crore) | PR Newswire, February 2026 (company retrospective) |
| 2025 (full year) | $72 billion | PR Newswire, February 2026 |
| October 2025 (single month, company’s highest) | $11.9 billion | PR Newswire, February 2026 |
| Cumulative, since inception through February 2026 | $100 billion (~₹9,60,000 crore), across roughly 5 million transactions | PR Newswire and VentureBurn, both February 2026 |
Revenue and profit/loss rows are omitted from this table rather than estimated, in line with the absence of any disclosed figure — LeadIQ’s third-party estimate of $10 million to $25 million in revenue (as of August 2026) is an algorithmic estimate, not a company or filing figure, and is not treated as verified here.
Where the money comes from
- Client base: more than 80 businesses across 12 countries, per Liminal’s own February 2026 press release marking its $100 billion transaction-volume milestone.
- Geography: headquartered in Singapore, with additional offices in Mumbai (India), Dubai and Abu Dhabi (UAE) and Taipei (Taiwan) — a footprint spanning APAC, the Middle East and South Asia (Liminal “About” page, accessed September 2026).
- Licensing: Liminal states it holds a Trust or Company Service Provider (TCSP) licence in Hong Kong for its self-custody wallet platform (Liminal “About” page, accessed September 2026); no Singapore Monetary Authority licence or Indian FIU-IND registration was confirmed in sources reviewed for this piece, so that status is not stated here.
- The surprise: for a company whose most famous moment was a scandal involving an Indian exchange, India is one office among several rather than the centre of the business — Liminal’s headquarters, largest disclosed client wins and highest-profile press coverage since 2024 have skewed toward its Singapore base and its APAC/MENA institutional client base broadly, not India specifically.
The risks
- Shared-key concentration risk: the WazirX breach showed that even a 4-of-6 multisig can be drained if an attacker compromises signers on both sides of the arrangement and defeats the custodian’s own approval interface — the exact mechanism described in Halborn’s technical write-up and the Wikipedia account of the incident. Any client relying on Liminal as one of several signers inherits this structural risk, however well the rest of the system is designed.
- Reputational contagion from a single incident: with roughly 80 disclosed institutional clients, Liminal operates in a market small enough that one high-profile dispute — publicly contested in the press by a former client — can become the reference case competitors cite for years, regardless of what a later audit concludes.
- Competing conclusions that never fully resolve: Mandiant’s August 2024 report and Liminal’s own Grant Thornton-commissioned audit a month later reached different implied conclusions about the same breach; when a security vendor’s exoneration comes from an audit it paid for, some portion of the market will always discount it, which is a risk no technical fix removes.
The takeaway
Being technically blameless is not the same as being trusted again. Liminal’s own commissioned audit found no compromise in its systems, and independent crypto outlets reported that finding without much pushback — and yet the company still lost its most visible Indian client, in public, within weeks of the breach. That is the transferable lesson for anyone building infrastructure that is supposed to be invisible: your reputation is a shared asset with your biggest client, and the day something goes wrong, the market does not wait for the audit before it starts asking who to blame. You can win the technical argument and still lose the trust argument, because they are not the same argument, and only one of them shows up in a press release.
Frequently asked questions
What does Liminal Custody actually do?
Liminal builds MPC and multi-signature wallet infrastructure and custody services for crypto exchanges, OTC desks, Web3 projects, hedge funds and family offices, so that moving digital assets requires multiple independent approvals rather than one person holding a key (Liminal product pages, accessed September 2026).
Who founded Liminal, and what did they do before?
Mahin Gupta founded Liminal in 2021. He had earlier launched Buysellbitco.in, one of India’s first bitcoin businesses, in 2012, and co-founded ZebPay, one of India’s largest crypto exchanges (Liminal “About” page and Startup Intros company profile, accessed September 2026).
Was Liminal responsible for the July 2024 WazirX hack?
This is disputed. A Mandiant report dated 14 August 2024 raised questions about Liminal’s environment; an audit Liminal commissioned from Grant Thornton, reported on 9 September 2024, found no evidence its systems were compromised. Both findings are attributed here to their respective reports and outlets, not stated as settled fact.
How much funding has Liminal Custody raised, and at what valuation?
Liminal’s only publicly disclosed round with a named size is a $4.7 million seed round announced in November 2023, led by Elevation Capital. CB Insights separately estimates a roughly $50 million valuation as of an earlier May 2022 seed close — a figure the company has not confirmed.
Does Liminal still work with WazirX?
No. WazirX announced on 14 August 2024 that it was ending its custody relationship with Liminal and moving assets to new multisig wallets, per CoinDesk’s reporting at the time; WazirX later restructured under a Singapore court-approved scheme and resumed operations in October 2025 with a different custody arrangement.
Sources
Figures are as of September 2026. Currency converted at $1 ≈ ₹96.0 as of 18 September 2026 (Trading Economics).
- Liminal company blog — “Liminal Raises a $4.7 Million Funding Round,” November 2023.
- Dark Reading — “Liminal Raises $4.7M Funding Led by Elevation Capital,” November 2023.
- CB Insights — Liminal company financials profile, accessed September 2026.
- Startup Intros — Liminal Custody company profile, accessed September 2026.
- LeadIQ — Liminal Custody company profile, accessed September 2026.
- Liminal company website — “About Liminal,” accessed September 2026.
- Liminal company website — “Inside Liminal: The Expert Team,” accessed September 2026.
- Liminal company website — “Institutional Digital Asset Custody,” accessed September 2026.
- PR Newswire — “Liminal Custody Crosses $100 Billion in Total Transaction Volume,” February 2026.
- VentureBurn — “Liminal Custody Surpasses $100 Billion in Institutional Transactions,” February 2026.
- Wikipedia — “2024 WazirX hack,” accessed September 2026.
- CoinDesk — “WazirX Ends Custody Relationship With Liminal, Is Moving Funds to New Multisig Wallets,” 14 August 2024.
- Mudit Gupta’s blog — “WazirX & Liminal hacked by North Koreans,” August 2024.
- Halborn — “Explained: The WazirX Hack (July 2024),” 2024.
- Crypto.news, Invezz, Bitget News and CryptoRank — coverage of the Grant Thornton audit clearing Liminal’s infrastructure, 9 September 2024.
Found an error? Write to us and we’ll correct it in the open, dated, on the piece.