Who is SK Masud Alam, the Trojan Horse who brought down WazirX?

by

As a seasoned analyst with years of experience in cybercrime investigations, I find this case particularly intriguing. The alleged involvement of SK Masud Alam, a seemingly ordinary resident of West Bengal, in the massive WazirX crypto exchange hack is a stark reminder of how cybercriminals often exploit the trust placed in digital platforms.

Approximately four months following the Rs 2000 crore hack of the cryptocurrency exchange WazirX, a man from West Bengal, India was apprehended by Delhi Police. The suspect, identified as SK Masud Alam, is believed to have played a role in the cyber attack. As per the police, Alam was a user on WazirX who facilitated the hacker by selling his account details for the unauthorized access.

Last Saturday, the Intelligence Fusion and Strategic Operations (IFSO) unit within the Delhi Police presented a case summary at the Patiala High Court (located in Delhi) regarding an accusation made against an unidentified cyber-attacker who targeted the WazirX cryptocurrency exchange.

In the extensive 918-page report, Delhi Police has implicated SK Masud Alam for plotting with a hacker to illegally acquire approximately $234.9 million in cryptocurrencies from WazirX’s multi-signature cold wallet. The document states that Alam is accused of conducting transactions amounting to lakhs of rupees within just two weeks after creating a fraudulent account on WazirX, which went undetected by the exchange management.

In this rephrased version, let’s explore a different way of expressing the same idea: By gaining exclusive access to the Delhi Police charge sheet, The Crypto Times is trying to construct a comprehensive picture of the individual acting as a Trojan horse, who guided the hacker to infiltrate WazirX’s user interface on July 18 for the cyber attack.

Who is SK Masud Alam?

As a crypto investor myself, I recently learned that according to a Delhi Police charge sheet, an individual named SK Masud Alam was apprehended. He hails from Dhekua village in Purba Medinipur district of West Bengal. Intriguingly, he had been operating a WazirX account under the alias Souvik Mandal, which was established in July this year, a few weeks prior to the hack that occurred on July 18th. The police stated that while Alam registered the account under the name of Mandal, he used his personal phone number for registration. This crucial detail allowed investigating officers to eventually trace and capture him.

As reported by the authorities, SK Masud Alam communicated with an individual claiming to be “M Hasan” on the Telegram platform. This person is said to have introduced themselves as such. The police claim that Alam then provided his WazirX account details to M Hasan through private messages on Telegram for a relatively small sum of money.

The police’s chargesheet indicates that conversations pertinent to the case were found on M Hasan’s mobile phone, which belonged to accused SK Masud Alam. Consequently, it is suggested that the accused was involved in the plot and the crime of this particular case began with the WazirX account established and used by the accused.

Masud Alam has been arrested under various provisions related to fraud, conspiracy, and intentional criminal acts, as outlined in the Indian Penal Code (IPC) Sections 318(4), 61(2), and 3(5). Additionally, he is being charged under specific sections of the Information Technology Act.

SK Masud Alam Traded on WazirX with Lakhs of Money: Delhi Police

It’s been reported by Delhi Police that the suspect, SK Masud Alam, operating under the pseudonym Souvik Mandal, received cryptocurrency deposits totaling approximately 91.17 lakh rupees in his WazirX account. This transfer occurred after he had apparently sold his account credentials to a hacker. The police also stated that Alam engaged in trading on the WazirX exchange, initially purchasing crypto worth around 54.37 lakh rupees, then selling crypto worth about 58.37 lakh rupees, and eventually withdrawing roughly 78 lakh rupees from Mandal’s wallet to various wallet addresses. These transactions were executed within a span of just 14 days after he created his account on WazirX.

It’s uncertain if WazirX exchange thoroughly verified the account responsible for significant trading activities within two weeks of registration, despite their claims of conducting enhanced due diligence (EDD) on large transactions. Additionally, a false name was used during the KYC process at WazirX. Given that the exchange is VDA approved and has emphasized EDD, it’s suggested that even basic compliance in this specific instance could have prevented the hack, according to an industry expert with access to the chargesheet details.

Read More

2024-11-19 12:36