In the early hours of Saturday, July 19, 2025, CoinDCX, a major cryptocurrency trading platform in India, confirmed that it had fallen victim to a cyberattack. The breach resulted in the loss of approximately $44 million from one of the company's internal operational accounts. As a precautionary measure, CoinDCX has suspended trading in its Web3 section.
CoinDCX co-founders, Neeraj Khandelwal and Sumit Gupta, took to social media to assure users that their assets are safe and that trading activity and INR withdrawals continue without interruption. Crypto withdrawals for customers who have the feature enabled are also functioning normally.
According to Sumit Gupta, the compromised internal operational account was used exclusively for liquidity provisioning on a partner exchange. The breach occurred due to a sophisticated server intrusion. Gupta stated that the company acted swiftly to contain the incident by isolating the affected account. Because CoinDCX's operational accounts are separate from customer wallets, the exposure is limited to the specific compromised account, and the loss will be absorbed by CoinDCX's treasury reserves.
The company's internal security and operations teams are collaborating with cybersecurity partners to investigate the incident, patch any vulnerabilities, and trace the movement of funds. CoinDCX is also working with its exchange partner to block and recover assets and plans to launch a bug bounty program soon to identify any remaining loopholes.
Blockchain investigator ZachXBT reported that the attacker's address was initially funded with 1 Ether from Tornado Cash, a crypto mixer used to obscure transaction trails. Subsequently, a portion of the stolen funds was transferred from Solana to Ethereum, further complicating efforts to track the funds.
The CoinDCX hack is the second major cyberattack on an Indian crypto exchange in the past year. In July 2024, WazirX experienced a security breach that resulted in the loss of $235 million in cryptocurrencies.
In response to the CoinDCX incident, cybersecurity experts recommend that users take immediate steps to protect their accounts, including resetting passwords and 2FA, revoking API access, checking transaction history, and monitoring credit/debit cards. They also advise users to move long-term investments to cold storage wallets where they control the private keys.
The CoinDCX cyberattack highlights the increasing need for robust security measures and regulatory oversight in the cryptocurrency industry. As crypto adoption grows, it is essential to protect investors from persistent cyber threats. The Indian government is expected to release its first crypto policy paper soon, and fund safety is likely to be a key focus area in shaping regulations around digital assets.
