Startup Deep Dive : WazirX — how a 34.9 million hack froze India’s second-largest crypto exchange for 15 months

WazirX called itself India’s largest crypto exchange even as its own users sat locked out of roughly ₹2,000 crore ($234.9 million) worth of their own coins for fifteen months. The company that had once out-argued the Reserve Bank of India’s banking ban in court could not out-argue a hacker who walked away, in a single afternoon in July 2024, with more money than WazirX had earned in its single best year on record.

That contradiction sits at the centre of this story: an exchange built by three friends who bet on crypto when Indian banks would not touch it, that grew into the country’s most recognised trading app, and then lost control of its customers’ money to a wallet it did not directly hold the keys to. What follows is how it got there, what the hack actually did to the business, and where the money and the users stand as of September 2026.

Quick facts

What they do

WazirX is a cryptocurrency exchange that lets Indian retail users buy, sell and hold digital assets against the rupee, and trade between cryptocurrencies against each other. As of September 2026 the company states it offers more than 350 cryptocurrencies and tokens, alongside corporate accounts, an API for algorithmic traders and a referral programme, and reports over 16 million registered users, as per the company’s own website. Its core customer has always been the first-time Indian retail investor: someone who wants to put a few thousand rupees into bitcoin or a smaller token without navigating an international exchange, a foreign bank wire or English-only support. That single insight, more than any technology, built the business.

The origin

Nischal Shetty was not new to building consumer software when he started WazirX. In 2010 he had launched JustUnfollow, a tool that let Twitter users see who had stopped following them, which grew to roughly 6 million users, as reported by Plisio’s profile of Shetty. After a $2.5 million Series A from Kalaari Capital, the product was rebranded Crowdfire and expanded into broader social media management, reportedly reaching over 20 million users at its peak before the company wound down in May 2025.

Shetty co-founded WazirX in 2017 with two people who had worked alongside him on those earlier products, Sameer Mhatre and Siddharth Menon, and the exchange went live on 8 March 2018. The founding insight was straightforward: Shetty had tried India’s existing crypto exchanges as a user in 2017 and found them opaque and clumsy, and he believed, in his own words reported by Ascendants.in, that crypto was “an extension” of the software wave that had already lifted the Indian economy. He backed that belief publicly, posting the hashtag “#IndiaWantsCrypto” every day for more than 1,000 consecutive days starting 1 November 2018, an unusually sustained piece of one-man lobbying for regulatory clarity, as documented by Plisio.

The struggle years

WazirX’s timing could not have been worse, or, in hindsight, more useful. One month after the exchange launched, the Reserve Bank of India issued a circular in April 2018 barring regulated banks from servicing any business dealing in cryptocurrency, cutting off the banking rails an exchange needs to move rupees in and out. Rather than shut down, WazirX pivoted to a peer-to-peer model that matched buyers and sellers directly and let them settle in rupees outside the banking ban’s reach, a workaround that kept the exchange alive until the Supreme Court of India struck down the RBI’s banking ban in March 2020.

The regulatory pressure did not end there. In August 2022, the Enforcement Directorate froze $8.1 million of WazirX crypto assets as part of a probe into instant personal loan fraud, alleging the exchange had lax anti-money-laundering checks that let proceeds from at least sixteen fintech lenders under investigation move to unknown foreign wallets, as reported by Cointelegraph and other outlets at the time. Business Standard separately reported the ED had frozen more than ₹64 crore of WazirX bank deposits and was scrutinising roughly ₹10,000 crore (about $130 million) in transactions across ten Indian crypto exchanges including WazirX. That same month, a separate and equally damaging dispute broke into public view: Binance, which had announced acquiring WazirX in November 2019, published a blog clarifying that it had only ever bought assets and intellectual property and held no equity in Zanmai Labs, the WazirX operating entity, contradicting Shetty’s account that the deal had been fully completed. Layer on India’s new crypto tax regime of a 1% tax deducted at source on every trade plus a 30% capital gains tax, introduced in 2022, and WazirX’s trading volumes are reported to have fallen more than 90% from pre-tax levels; none of this had killed the company by the middle of 2024, but it had left it financially thinner and politically exposed just before the event that actually broke it.

The turning point

On 18 July 2024, WazirX lost approximately $234.9 million in digital assets in a single attack on a multi-signature wallet that the exchange operated under a third-party custody arrangement with Liminal Custody, according to Wikipedia’s account of the incident corroborated by contemporaneous reporting from CoinDesk and security firm Halborn. Attackers reportedly created a fake WazirX account, used it to drain the hot wallet, then manipulated the smart contract governing the cold-storage multisig wallet to seize full control without ever needing the exchange’s own signing keys; the intrusion has since been attributed to North Korea’s Lazarus Group. It stands as one of the largest crypto exchange hacks on record.

The scale of the loss only becomes clear against what came before it. WazirX had reported ₹823 crore ($108.4 million) in revenue in FY22, its best disclosed year; the hack wiped out more dollar value in one day than the company had earned in commissions across its entire strongest fiscal year. WazirX halted all trading and withdrawals immediately, and the platform stayed effectively frozen for fifteen months, only resuming operations on 24 October 2025, after Zanmai’s Singapore parent, Zettai Pte Ltd, secured court approval for a creditor restructuring scheme. In the interim, WazirX and Liminal each commissioned their own forensic reviews and each cleared themselves: WazirX cited a Mandiant probe pointing to Liminal’s side of the process, while Liminal cited a Grant Thornton audit of its own systems finding no compromise. As of September 2026, responsibility for the breach remains formally unresolved between the two companies.

The money behind it

WazirX was not built on the large, serial venture rounds that defined most Indian consumer startups of its era. Public funding trackers point to a small pre-Binance private token sale of under $1 million and early angel-style backing that reportedly included Kalaari Capital and Cognisa Capital, though neither WazirX nor those investors have published a full capitalisation history. The company’s real capital event came through Binance: in November 2019, Binance announced it had acquired WazirX, and in February 2020 the two companies ran a $200 million initial exchange offering of the WRX token on Binance Launchpad, which functioned as WazirX’s primary fundraising and liquidity event rather than a conventional priced equity round.

What Binance actually bought is the unresolved question at the heart of the company’s structure. Binance’s own blog, amended in August 2022, states it purchased assets and intellectual property from WazirX and holds no equity in Zanmai Labs, while WazirX’s founders have maintained the acquisition of the business, not merely its brand, was completed, according to reporting summarised by Mudrex and Coingeek. The Enforcement Directorate has separately alleged that Zanmai Labs used a web of agreements involving Crowdfire Inc. in the United States, Binance and the Singapore-registered Zettai Pte Ltd to obscure who actually controls the exchange. No priced valuation for WazirX as a company has been publicly disclosed since the Binance deal; the closest public proxy for “money behind it” remains the $200 million token raise, not a venture valuation.

How it makes money

WazirX earns money the way most spot exchanges do: a percentage commission charged on every buy and sell order that executes on its platform, supplemented by fees on INR deposits and withdrawals and revenue from ancillary technology and software services it has sold to other businesses. In its last fully disclosed high-growth year, FY22, trading commissions of ₹774.4 crore ($101.9 million) made up 94.0% of total collections, with software and ancillary services contributing the remaining ₹53.2 crore ($7 million), according to Entrackr’s analysis of the company’s financial filings.

The part outsiders tend to get wrong is assuming an exchange’s revenue tracks the price of bitcoin. It does not; it tracks trading volume and the number of active traders willing to pay a spread, which is why India’s 2022 tax changes hurt WazirX far more than any crypto market downturn did. A 1% tax deducted at source on every trade made short-term, high-frequency trading uneconomical overnight, and volumes across Indian exchanges, WazirX included, are reported to have fallen more than 90% as traders moved to offshore platforms or exited altogether. An exchange’s commission model only works at scale; when the trades stop, the revenue does not gradually taper, it collapses.

The numbers

WazirX’s own operating entity, Zanmai Labs Private Limited, has not published a continuous, audited revenue and profit series through its most difficult years; FY23 and FY24 figures were not available in public company-registry summaries at the time of writing. The years that are documented show the shape of the business clearly enough: explosive growth through the 2021 retail crypto boom, followed by collapse.

Two figures anchor that table. Entrackr reported, in January 2023, that WazirX’s revenue jumped 7.3 times to ₹823 crore in FY22 from ₹112.5 crore in FY21, with net profit growing 6.4 times to ₹53.2 crore. Then, TheCompanyCheck’s company profile, accessed in September 2026, shows Zanmai Labs’ revenue at just ₹22.03 crore for FY25, the fiscal year that contains the July 2024 hack, a 56.0% decline year-on-year that the profile flags without a corresponding profit figure, which remains undisclosed. The missing FY23-FY24 years likely capture the intermediate damage from the 2022 tax changes; the FY25 number captures a company that spent most of that year unable to legally take a single trade.

Where the money comes from

WazirX’s revenue base has always been almost entirely one product in one country: rupee-denominated retail trading commissions inside India, with the FY22 split of 94.0% trading commission against 6.0% software and ancillary revenue as the clearest disclosed picture of that mix, per Entrackr. There is no meaningful reported geography split because WazirX, unlike Binance or other global exchanges it has been compared to, has not built a material non-Indian retail user base; its 16 million-plus registered users, as stated on the company’s own site, are overwhelmingly domestic.

The surprise, for a company frequently described as “India’s largest” crypto exchange, in its own marketing, is that independent market-share data no longer supports that framing. Data compiled by CoinGecko and cited in Koinly’s 2026 review of Indian exchanges put Bitbns first among Indian crypto platforms with 79.1% of the tracked market, with WazirX second at 11.1% and CoinDCX third at 6.6%. The two claims are not strictly comparable, since WazirX’s tagline typically refers to historic INR trading volumes, while the CoinGecko figures reflect a snapshot of current market share after WazirX’s fifteen-month shutdown reshuffled where Indian traders parked their money; both are worth holding in mind together rather than picking one.

The risks

Three risks sit underneath WazirX’s business today, and each has already materialised at least once rather than being theoretical. The first is regulatory concentration: with essentially all its revenue tied to Indian retail trading, a single tax policy change in 2022 was enough to cut volumes by more than 90%, and any future tightening carries the same mechanism of risk. The second is custody risk, demonstrated directly by the July 2024 hack: outsourcing control of a multisig wallet to a third party such as Liminal Custody meant WazirX’s exposure depended on a security chain it did not fully control, and the unresolved dispute over which party’s systems were actually compromised shows how hard that risk is to price or insure against after the fact. The third is legal and governance overhang: the Enforcement Directorate’s money-laundering probe, open since 2022, and the unresolved Binance ownership dispute both remain live as of September 2026, and until the corporate ownership question is settled it is genuinely unclear which entity bears ultimate accountability for the exchange’s obligations. A fourth, more immediate risk for existing users is that even after the October 2025 relaunch, roughly 34% of certain older INR account balances remain frozen and tied to separate law-enforcement proceedings, with founder Nischal Shetty declining, in a 31 August 2026 community session, to give any timeline for their release, as reported by CryptoTimes.

The takeaway

The transferable lesson from WazirX is not “crypto is risky,” it is narrower and more useful than that: when the thing you sell your customers is custody of their money, outsourcing the technical control of that custody without retaining the accountability chain turns a vendor problem into an existential one. WazirX did not lose $234.9 million because bitcoin fell in price; it lost it because a wallet it depended on, but did not fully control, was compromised, and the aftermath showed how quickly a dispute over blame can become a fifteen-month freeze for everyone else. Any business whose core promise rests on holding someone else’s asset, financial or otherwise, inherits this same test: you can delegate the operation, but you cannot delegate the responsibility.

Frequently asked questions

What caused the WazirX hack of July 2024?

On 18 July 2024, attackers compromised the process around a multi-signature wallet that WazirX operated with third-party custodian Liminal Custody, reportedly manipulating the smart contract controlling the wallet to gain full access and drain roughly $234.9 million in crypto assets, an attack later attributed to North Korea’s Lazarus Group.

How much money did WazirX users lose, and how much has been recovered?

Around $234.9 million (about ₹2,000 crore) was stolen. Under a Singapore High Court-approved restructuring scheme sanctioned on 13 October 2025, eligible users received about 85.5% of their claim value within ten business days of the approval, with the remaining 14.5% issued as non-tradable Recovery Tokens credited to accounts on 9 January 2026.

Does Binance own WazirX?

This is disputed. Binance announced it had acquired WazirX in November 2019, but in an August 2022 blog update said it had only purchased assets and intellectual property and held no equity in Zanmai Labs, WazirX’s Indian operating company. WazirX’s founders maintain the acquisition of the business was completed. The dispute remains unresolved as of September 2026.

Is WazirX operating again in September 2026?

Yes. WazirX resumed trading and withdrawals on 24 October 2025 after the Singapore court approval, using BitGo as its new custody partner. However, roughly 34% of certain older INR account balances tied to separate law-enforcement proceedings remained frozen with no release timeline as of a 31 August 2026 community session with founder Nischal Shetty.

What is a WazirX Recovery Token?

It is a non-tradable token issued to users under the court-approved restructuring scheme to represent their pro-rata share of the 14.5% of claims not paid out in the initial cash-equivalent distribution. WazirX has said it will consider buying back these tokens once unencumbered recoveries in a given quarter exceed $10 million.

Sources

Figures are as of September 2026. Currency converted at $1 ≈ ₹96.0 as of 18 September 2026 (Trading Economics).

• Wikipedia, “2024 WazirX hack” (accessed September 2026)
• Wikipedia, “WazirX” (accessed September 2026)
• Entrackr, “WazirX crosses $100 Mn in revenue in FY22, profit grows 6.4X” (January 2023)
• TheCompanyCheck, “Zanmai Labs Private Limited – FY 2026 Profile” (accessed September 2026)
• Medianama, “WazirX Crypto Exchange Scheme Gets Singapore HC Approval” (October 2025)
• Inc42, “WazirX Vs Binance Spat – Will This Wipe Out WRX Token’s $92 Mn Market Cap?” (August 2022)
• CryptoTimes, “WazirX AMA Ends the Sept 14 INR Unfreeze Rumor. What Shetty Said Instead Should Worry the 34%” (September 2026)
• Ascendants.in, “WazirX: The Powerhouse Fueling India’s Crypto Dream” (accessed September 2026)
• Plisio, “Who Is Nischal Shetty? WazirX Founder and Shardeum CEO” (accessed September 2026)
• WazirX Blog, “About WazirX” (accessed September 2026)
• Koinly, “Best Crypto Exchanges in India: 10 Top Picks for 2026” (accessed September 2026)
• CoinDesk, “WazirX Hacker Is Almost Done Laundering $230M Stolen Funds” (September 2024)
• Halborn, “Explained: The WazirX Hack (July 2024)” (2024)
• Business Standard, “ED seizes over Rs 64-crore bank deposits of crypto exchange WazirX” and “Ten crypto exchanges under ED lens for allegedly laundering Rs 10 billion” (August 2022)
• Cointelegraph, “Indian law enforcement accuses WazirX exchange of aiding in laundering of $130M” (2022)
• Mudrex Learn, “Who Really Owns WazirX? Binance vs WazirX Feud” (accessed September 2026)

Found an error? Write to us and we’ll correct it in the open, dated, on the piece.