CoinDCX suffers $44 million hack, says customer funds are safe: All you need to know

Indian cryptocurrency exchange CoinDCX has confirmed a cyberattack that led to a loss of $44 million in digital assets from one of its internal accounts. The breach, which occurred on July 19, is the second major hack involving an Indian crypto exchange within a year, following the high-profile WazirX breach in 2024.

According to cofounders Sumit Gupta and Neeraj Khandelwal, the attack exploited a server-side vulnerability in an internal liquidity provisioning account. This account is used to maintain crypto reserves for smoother transactions on the platform. CoinDCX described the hack as a “sophisticated” breach of its infrastructure.

Importantly, the company said that customer assets were not compromised. “User funds are stored in secure cold wallets and remain unaffected,” the exchange clarified in a public update. CoinDCX has suspended its Web3 services temporarily to contain the breach but assured users that centralised trading, INR deposits, and withdrawals continue to function normally. The company has committed to covering the full loss from its own treasury.

The firm’s internal security team is working alongside external cybersecurity partners to investigate the breach and trace the stolen funds. CoinDCX is also coordinating with a partner exchange to freeze any illicit transfers and is planning a bug bounty programme to strengthen its defences going forward.

The incident sparked panic among users, with many flooding social media for updates. The sudden traffic surge caused temporary strain on CoinDCX’s servers, particularly its portfolio services. The company has since added more server capacity to manage demand.

Founded in 2018, CoinDCX is one of India’s largest cryptocurrency exchanges. The company became the country’s first crypto unicorn in 2021 and is currently valued at approximately $2.3 billion. Its backers include B Capital, Coinbase Ventures, Bain Capital Ventures, and Polychain Capital.

CoinDCX offers multiple services including a beginner-friendly investment app, CoinDCX Pro for advanced traders, CoinDCX Earn for passive income on holdings, and a Web3 mode with access to over 50,000 tokens. It also operates CoinDCX Ventures, which invests in early-stage blockchain startups.

The hack brings back memories of the 2024 WazirX breach, where hackers stole over $230 million by exploiting vulnerabilities in a multisignature wallet. That attack was later linked to North Korea–affiliated groups such as the Lazarus Group.

While crypto trading is legal in India, the sector still lacks a comprehensive regulatory framework. Transactions are subject to a 30% tax on gains and a 1% TDS, which has dampened trading activity. The Financial Intelligence Unit issued show-cause notices in 2023 to offshore exchanges for violating anti-money laundering norms, but regulatory clarity remains elusive.