‘We’ve not seen a crypto exchange come back after about 45 per cent of the value on the platform was impacted.’

IMAGE: Nischal Shetty, Founder and CEO, WazirX. Photograph: Kind courtesy WazirX.com

 

Indian crypto exchange WazirX is picking up from where it left 15 months ago, when a breach wiped out over $230 million.

The platform resumed operations last month after completing its restructuring in Singapore.

Founder and CEO Nischal Shetty outlines a road map for the restart, among other issues, in a video interaction with Ajinkya Kawale and Shivani Shinde/Business Standard.

What is the update following the relaunch of the WazirX platform in India after you got a nod from the Singapore court?

There was no playbook for something like this. We’ve not seen a crypto exchange come back after about 45 per cent of the value on the platform was impacted.

We took a phased approach before restarting, launching in four phases.

We saw new buyers coming in, and less people left the platform compared to what we thought.

The platform categorised users in three buckets.

One, people who would want to sell because they have not been able to do so in the past 15 months; second, who want to completely exit the platform and third, who would continue to trade.

The majority are in the category where they’re continuing to use the platform.

What have been the major learnings from the incident?

Clear communication helped a lot. We had several town halls, content created within the app, on our blog post through the entire restructuring process.

One can’t communicate effectively to the entire four million people who were impacted, but we made sure that the majority were (communicated) while keeping our support channels open all through.

We continue to answer people’s questions. We have put in measures such as partnership with BitGo (infrastructure provider for virtual digital assets).

It is the largest custody provider with over $90 billion worth of assets under its custody. It also offers $250 million in insurance.

We’re putting in efforts to ensure that our platform still remains secure.

Earlier, we were using a third-party infrastructure provider (Liminal Custody). That’s where the attack happened. It was not on our servers or on the WazirX Web site.

Liminal has maintained the breach did not happen on its part.

It’s only possible to know when both sides cooperate and have a fair analysis through a third party or an independent assessment.

We were using the Liminal Web site and we had three devices that were using it. We don’t have anything beyond that.

I don’t think there’s been a deep analysis on what happened. We are trying to figure out and understand.

It’s like a black box for us since there’s nothing beyond that Web site that we used. So, there’s only so much we can do.

Now, legally we’ll have to figure out but that takes time.

Have both of you discussed any opportunities to collaborate on the investigation?

We have tried. If you have not seen a proper report, it means it has not happened.

But attempts have been made now, and we definitely want to understand the truth and what led to this.

The majority of our efforts were focussed on restarting. Now that we have the bandwidth, we’ll get into it.

Attempts were made (to collaborate), but it’s not turned out the way everyone would want it to be.

By when do you expect the user base to go back to its normal state again?

It’s hard to predict. It will take at least three to six months where we’ll be able to normalise all the operations and other things.

We’ll have to put more effort into attracting active traders back to our platform.

Since the platform was not operational, they had to go to other exchanges to start trading on a daily basis.

We’ll need one or two quarters to win back all our active traders.

Why was the Panama-based entity left undisclosed, resulting in the court’s initial rejection of the restructuring plan?

When we went for the first round of restructuring, there was no need for any other entity.

It was normal — we had the Singapore entity and the Indian entity, and that was all.

We got a positive vote. The next step was a court hearing, and the court would approve it if nothing was wrong with the scheme since the majority had voted in favour.

But four days before the hearing, Singapore introduced a new law requiring anyone operating in Singapore to have a licence, even if it didn’t serve Singapore customers.

We didn’t know it would become law just four days before our hearing.

We knew we couldn’t go ahead with the existing structure because we didn’t have a licence, and the court wouldn’t approve it.

So, we suggested using a Panama entity, because we needed a jurisdiction with no such regulation.

The issue was that this should have been part of the original scheme — which would have happened if the law had changed earlier.

When we explained this to the court, the court did not reject the scheme. Instead, it asked us to change it and get a fresh vote so everyone was aware.

That gave us time to decide whether we wanted to go that route, and eventually we chose the easier route of using the India entity.

When was the Panama entity established, around the same time or was it there for some time already?

It was established after the (first) voting was done. It was created because we needed a subsidiary to issue the recovery token — that was already part of the scheme.

The plan clearly stated that we would set up subsidiaries for the recovery token and potentially for future businesses.

We only considered using it for existing funds after the Singapore law changed, in case the law is an issue there.

There are entities in Panama; Zensui Corporation, Zensui Recovery Corporation and Zensui Foundation. Were all of the disclosed during restructuring in Singapore?

What we disclosed was that we would need subsidiaries to issue recovery tokens and to build new businesses.

The number and names of those subsidiaries weren’t in the scheme because once you do that, then you have to go with it.

If laws change again and a jurisdiction becomes unusable, we would need to choose another place.

So we took an overview approach — stating that we would create new subsidiaries or entities as needed for new businesses and token issuance.

One of them is a foundation we don’t own; Zensui is the one we do own and planned to use.

But after changing the scheme and moving all funds to the India entity, there’s no need to disclose an entity that is no longer being used.

Would there be any adverse outcome from your ongoing litigation in India impacting your operations?

Our legal team will look into it. The scheme has already been implemented, it’s active, and it’s binding on all 4 million creditors, who now have access to their crypto.

Whatever the outcome of the Indian litigation, we’ll go as per what’s appropriate.

We know our positions, and we’re confident they’re the right ones, so we’re not concerned.

These litigations each have their own reasons. We’ll tackle them as they come, but from an operations standpoint, we don’t see any concerns.

What’s the status of WazirX’s dispute with Binance?

That dispute is ongoing, and when the outcome comes, the scheme already has provisions for the outcomes.

Depending on who is deemed the ultimate owner, it may or may not have an impact — but for the end user, nothing changes.

Feature Presentation: Ashish Narsale/Rediff