WazirX, one of India’s largest cryptocurrency exchanges, suffered a loss of more than $235 million. Following this attack, the exchange began executing a phased plan to restart operations and provide users with access to their funds. However, the fact that the hacker is still actively transferring funds creates a significant security problem in this process.

Blockchain security platform Cyvers announced in a post on the X platform on September 3 that the hacker transferred the stolen funds to Tornado Cash. Tornado Cash is known as a mixer used to hide the traces of cryptocurrencies.

In total, the hacker attempted to launder 2,600 Ether (worth approximately $6.5 million at current prices) through Tornado Cash. These transfers were made in small pieces to make it difficult to trace the cryptocurrency.

According to information provided by data tracking platform DeBank, the hacker’s wallet address held funds worth $6.7 million in total as of September 2. But in just one hour, the hacker made 26 separate transfers of 100 ETH to Tornado Cash, leaving only $154,000 in the wallet.

These rapid fund movements show that the hacker uses various methods to leave no trace. Platforms such as Tornado Cash allow users to hide their identities and can be used in illegal activities.

These developments took place just before WazirX offered users the opportunity to withdraw their funds. WazirX announced that it allows withdrawing up to 66% of Indian Rupee (INR) token balances. Shooting time started about a week ahead of schedule.

In a post on the X platform on September 3, WazirX announced that this opportunity was provided to its users. The withdrawal period, which was originally planned to start on September 9, was brought forward so that users could access their funds earlier.

This difficult process that WazirX is facing started with a major attack on July 18. This attack caused the stock market to lose $235 million. Following the attack, the exchange began taking a series of steps to restore normal financial operations.

These steps include resuming Indian Rupee withdrawals. As of Monday, August 26, the exchange gradually began allowing withdrawal transactions.

However, some difficulties remain in this process. On August 23, WazirX stated that 34% of balances in INR were “frozen” and that these balances could not be withdrawn immediately due to ongoing investigations.

WazirX faces several legal hurdles, complicating the exchange’s restructuring process. The exchange chose a jurisdiction for the legal restructuring process in Singapore and initiated legal proceedings there.

These challenges facing WazirX affect not only the exchange but also its users. While users’ access to their funds remains limited, the exchange is also trying to combat legal and operational hurdles.

WazirX is taking various steps to regain user trust in this process, but the fact that the hacker is still actively transferring stolen funds stands out as one of the biggest threats facing the exchange.