WazirX hack: Do crypto investors have any legal recourse?

WazirX, which has 1.5 crore investors, faced a cyberattack on July 18, 2024, resulting in $230 million being stolen.

For Aakash, who had invested in crypto assets such as bitcoin, ether and matic on the WazirX platform, this would have been the perfect time to take some profit off the table after a more than 100 per cent rally in major crypto assets over the past one year. He wanted to reduce some risk because of the simmering geopolitical tension in the Middle East.

However, just like Aakash (name changed to conceal identity), there are lakhs of Indian crypto investors who are praying for the speedy resolution to the WazirX hacking episode. The rallies and corrections in the crypto world are fast and furious. However, with the freeze on crypto withdrawals and trading, investors are left in a lurch.

WazirX, which has 1.5 crore investors, faced a cyberattack on July 18. The cyberattack led to a theft of $230 million that was stolen from its Ethereum Wallet.

In response, WazirX announced a bounty of $23 million to help recover stolen assets and suspended trading on the platform and froze crypto withdrawals.  The hack deeply impacted the platform’s ability to maintain 1:1 collateral with assets. Investors can still withdraw partial amounts from their Indian rupee (INR) wallets on the platform.

Also read | Winning the mid-cap race: How fund managers made their moves

To restructure the crypto liabilities of the platform, Singapore’s Zettai Pte, which runs the cryptocurrency platform WazirX, filed a moratorium application in Singapore and the plea was granted a few days ago.

Zanmai, a company incorporated in India, is the entity that registered the WazirX platform with the Indian FIU (Financial Intelligence Unit) in 2023.

The exchange has suggested a “Socialised Loss” strategy, where the losses from the cyberattack would be shared among all crypto portfolio users in a fair and equitable way.

While the relevant authorities in India and Singapore are investigating the cyberattack carried out against WazirX, the exchange is looking at ways to return investors’ money.

What is expected from WazirX during the moratorium period?

According to WazirX, the exchange is pursuing a solution to return token assets to crypto users, which will allow improvements to recoveries from any increase in market prices, and to improve user recoveries via tracing and recovery of stolen tokens, implementation of revenue-generating products (and sharing of profits), and rescue financing from and/or collaborations with potential white knights.

“During the four-month moratorium, WazirX will focus on publicly disclosing wallet addresses via a court affidavit, respond to user queries raised during court proceedings, and release its financial information,” the exchange said in an e-mail response to Moneycontrol's queries.

The exchange disclosed that it has made further progress in its discussions with potential white knights.

“Zettai has received in total three preliminary proposals from large cryptocurrency exchanges with millions of users,” WazirX said.

Are there any hopes of recovering stolen assets?

According to crypto market experts, the hackers of WazirX have nearly completed their efforts to launder the $230 million sum via a coin mixer platform, Tornado Cash.

Tornado Cash software is like a washing machine, where you put in crypto, and you get crypto through different addresses and even separate tokens. So, the blockchain trail gets broken, making it difficult to track the assets.

“In the past, if hackers had an intention of giving the money back, they would contact the exchange within a week. Now, the chances of recovery are slim. The only remaining hope is that every single regulator around the world does not recognise the mixer,” said Kashif Raza, founder of Bitinning.

Also read | Gold loan risks: RBI exposes irregularities, borrowers beware

WazirX  is concurrently working with zeroShadow, a web3 security solutions provider; and Kroll, a financial and risk advisory firm, to trace assets, understand the likelihood of recovery and propose the next steps for recovery.

What legal recourse do investors have?

Crypto assets are unregulated in India. The Reserve Bank of India (RBI) has time and again reiterated its stance on ban on these digital assets.

“Cryptocurrencies in India operate in a regulatory grey area, and incidents like the WazirX case highlight the risks faced by investors,” said Prithiviraj Senthil Nathan, Partner, King Stubb & Kasiva, Advocates and Attorneys.

While the legal framework for cryptocurrencies remains underdeveloped, investors still have certain rights under Indian law and they can take legal action under various provisions.

“Investors who entered into contracts with cryptocurrency platforms such as WazirX can rely on the specific terms laid out in their investment agreements. These agreements typically contain clauses related to the security of funds, obligations for safeguarding digital assets, and the right to compensation in case of cybersecurity breaches,” said Nathan.

To be sure, WazirX, in its user agreement, says that the firm is not responsible for damages caused by delay or failure to perform undertakings under the agreement when the delay or failure is due to fires, strikes, floods, power outages or failures, acts of God or the state’s enemies, computer, server, or internet malfunctions, security breaches or cyberattacks or\criminal acts.

However, legal experts believe that even in fraud or theft, investors can enforce contractual rights in Indian courts, seeking financial recovery or damages.

Asish Philip, Partner, Lakshmikumaran & Sridharan Attorneys says that despite the lack of crypto asset regulations, a user availing the services of a company in India can file a case under various existing regulations based on contractual arrangements.

"Apart from criminal remedies for theft and breach of trust under Bharatiya Nyaya Sanhita and IT regulations, users can explore civil suits enforcing the contractual remedy can be filed. Also, now under consumer protection, there's an option to have a class action suit for deficiency in services as a cost-effective remedy, contractual responsibilities under multiparty arrangements in a digital ecosystem pose additional challenges in jurisdiction and enforcement. The interplay of moratorium under IBC by Singapore courts with domestic laws of the country is unchartered territory and needs to be tested in courts," said Philip..

Further, in cases of cryptocurrency theft or fraud, investors may experience a dilution in the value of their holdings. Investors can claim compensation for losses sustained due to platform negligence, fraud, or breach of contractual obligations. Investors can also take legal action for recovery of the lost or stolen assets, either through civil proceedings or through claims under the law for breach of fiduciary duty or negligence.

Also read | Three key factors that you should consider when investing

Users have also rights under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, or SPDI Rules, under which cryptocurrency platforms that handle personal data must ensure its protection. Also, Under Data Privacy Rights, investors are protected by Indian data privacy laws, which mandate that platforms collect and use personal data only with explicit consent.

The way forward

According to Sidharth Sogani, Founder and Chief Executive Officer (CEO) of CREBACO, a crypto research firm, Indian investors have lost faith in the crypto ecosystem.

To safeguard their money, Sogani suggests long-term holders to withdraw their crypto assets and keep them in their own hardware wallet.

Experts are in favour of crypto regulations to safeguard retail investors' interests.

“There is a need to bring crypto assets under the purview of existing regulators such as SEBI [Securities and Exchange Board of India], RBI or Meity [Ministry of Electronics and Information Technology], or an independent regulator fully governing crypto exchanges,” said Stella Joseph, Partner Tax Mumbai, Economic Laws Practice.

The WazirX case serves as an important lesson for investors who engage with cryptocurrency platforms. Amid the lack of regulations, it is recommended that investors must conduct  due diligence on cryptocurrency platforms' track record, security protocols, and legal standing before making any kind of investment.

Also read | Israel-Iran crisis: Avoid knee-jerk reaction, use any correction to deploy cash into equities, say money managers