CoinDCX Reports $44 Million Breach, Assures User Funds Safe

Download IPFS

A major security breach at CoinDCX, one of India’s largest cryptocurrency platforms, has led to the loss of $44 million from an internal account. The company has confirmed that no customer funds were affected, emphasising that all user assets remain secure and stored in offline cold wallets. This incident marks the second significant crypto exchange hack in India within the past year and once again highlights the fragile nature of cybersecurity in the digital asset space.

The breach occurred on July 19 and targeted an internal liquidity provisioning account used to support transaction efficiency on the platform. According to cofounders Sumit Gupta and Neeraj Khandelwal, attackers exploited a server-side vulnerability to gain unauthorised access. CoinDCX described the hack as a sophisticated infiltration of its infrastructure and promptly suspended Web3 services to prevent further impact. However, core operations such as centralised trading, deposits, and withdrawals in Indian Rupees (INR) continue to function without interruption.

In a statement, CoinDCX assured its users that it will absorb the full financial loss from the company’s treasury. “User funds are unaffected and securely stored,” the company stated in a public update. CoinDCX’s internal security team is actively collaborating with external cybersecurity specialists to track the stolen assets and identify those responsible. The firm is also working with a partner exchange to freeze any suspicious transactions and intends to launch a bug bounty program aimed at enhancing long-term security.

Founded in 2018, CoinDCX has grown into one of India’s most prominent digital currency platforms and reached a valuation of $2.3 billion after becoming the country’s first crypto unicorn in 2021. Its backers include major investment firms such as Bain Capital Ventures, Polychain Capital, Coinbase Ventures, and B Capital. The exchange offers a range of services, including CoinDCX Pro for experienced traders, CoinDCX Earn for passive returns, and a Web3 interface providing access to over 50,000 tokens. It also operates CoinDCX Ventures, an arm that supports early-stage blockchain start-ups.

This incident echoes the 2024 breach of WazirX, another leading Indian exchange, where hackers stole over $230 million by exploiting weaknesses in a multisignature wallet. That event was later linked to the Lazarus Group, a cybercrime syndicate with connections to North Korea.

While cryptocurrency trading is legal in India, the sector remains hampered by an unclear regulatory landscape. Transactions face steep taxation, with a 30% levy on capital gains and a 1% tax deducted at source (TDS) on every transaction. In 2023, the Financial Intelligence Unit (FIU) issued compliance notices to several offshore exchanges over violations of anti-money laundering protocols. Despite these efforts, the regulatory picture for the crypto industry remains incomplete.

CoinDCX’s swift response and transparency may help it retain user trust, but the breach reinforces the need for tighter internal controls and broader regulatory clarity in the fast-evolving world of digital finance.