$44 Million Stolen in Cyberattack on CoinDCX: Internal Account Breached, Trading Continues Uninterrupted

Download IPFS

India’s leading cryptocurrency exchange, CoinDCX, has confirmed a major security breach that resulted in the theft of approximately $44 million (₹380 crore) from one of its internal treasury accounts. While the company has assured users that no customer funds were affected, the incident highlights growing concerns about digital asset security amid the rising sophistication of cybercriminals. While the company has assured users that no customer funds were affected, the incident highlights growing concerns about digital‑asset security amid increasingly sophisticated cybercriminal tactics.

According to CoinDCX co-founder Neeraj Khandelwal, the compromised account belonged to the company’s treasury and was not linked to user wallets or customer-facing operations. “The total amount lost was ~$44 million out of our treasury assets,” Khandelwal stated in a post on X (formerly Twitter). “CoinDCX Treasury will be bearing these losses. Our first and foremost objective throughout the day has been to first secure assets.” CoinDCX Treasury will bear the losses, and our first objective throughout the incident was to secure all assets.

Co-founder and Chief Executive Officer Sumit Gupta provided additional context, explaining that the breach targeted an internal operational account used to manage liquidity on a partner platform. Gupta described the incident as a “sophisticated” server-side compromise, noting that the company’s team acted quickly to isolate the affected account and contain the threat.

In the aftermath of the attack, CoinDCX has paused trading in its Web3 segment as a precaution and has brought in external cybersecurity professionals to conduct a full investigation. In response to the breach, CoinDCX has paused Web3 trading as a precaution and engaged external cybersecurity experts to conduct a full investigation. “Every security incident is a learning, and we will learn from this,” Gupta said, emphasizing that CoinDCX remains committed to strengthening its platform and working with industry experts to combat cyber threats. The firm also plans to launch a bug bounty program, an initiative that rewards independent security researchers who identify vulnerabilities as part of its effort to bolster security.

Despite the incident, Gupta reassured users that regular platform operations remain unaffected. “All customer assets are safe and the trading activity plus the INR [Indian Rupee] withdrawals continue unhindered,” he confirmed.

This latest attack makes CoinDCX the second Indian cryptocurrency exchange to fall victim to a cyber intrusion within the past year. In July 2024, rival platform WazirX suffered a far larger breach, losing approximately $234 million in cryptocurrencies due to the compromise of a wallet hosted by third-party custodian Liminal. This latest attack makes CoinDCX the second major Indian cryptocurrency exchange to suffer a cyber intrusion in a year. In July 2024, rival WazirX lost about $235 million in a hack involving a multisig wallet, reportedly linked to third-party custodian Liminal.

The CoinDCX hack serves as another stark reminder that, while the crypto market offers cutting-edge financial technology, it also comes with serious operational risks. The sector’s decentralized nature, paired with the increasing complexity of cyberattacks, puts the onus on firms to be proactive, transparent, and resilient in their response.

As regulators and financial institutions take a more active interest in the cryptocurrency space, incidents like this could shape how digital asset platforms are governed in the future. For now, CoinDCX’s swift response and transparency offer a degree of reassurance, but the breach reinforces a hard truth: in the high-speed world of digital finance, security must evolve just as quickly as innovation.