Indian crypto exchange hacks have drained over $290M, from WazirX's Lazarus theft to the CoinDCX. See how each happened and how to stay safe.
Author: Kritika Gupta
India’s crypto market has grown rapidly, but Indian crypto exchange hacks and investment scams have also caused substantial losses. From major wallet breaches to multi-crore Ponzi schemes, investors have faced platform failures, delayed disclosures, and limited recovery options.
Across these cases, familiar weaknesses emerge: social engineering, concentrated employee access, weak operational controls, and slow public communication. Meanwhile, gaps in custody standards and investor protection leave users exposed when platforms fail.
On July 19, 2025, CoinDCX lost roughly $44 million from an internal operational account that supplied liquidity on a partner exchange, marking one of the largest Indian crypto exchange hacks. However, the attackers did not access customer wallets. Instead, CoinDCX covered the loss from its treasury and stated that user funds remained safe.
Investigators subsequently linked the breach to a social-engineering attack. According to police, hackers posed as recruiters offering freelance work and persuaded CoinDCX software engineer Rahul Agarwal to install malware on his company-issued laptop. The malware then compromised his credentials.
Initially, a test transfer of 1 USDT occurred around 2:37 a.m. Hours later, the attackers drained approximately $44 million into six wallets. On-chain tracking identified roughly 4,443 ETH, worth around $15.7 million, and 155,830 SOL, worth around $27.6 million.
Following the breach, Bengaluru police arrested Agarwal on July 26. He admitted to moonlighting on the company laptop but denied knowing that the job offer served as a trap. Additionally, police flagged a suspicious deposit into his account and a WhatsApp call from a German number. CoinDCX filed its complaint through its parent company, Neblio Technologies.
Meanwhile, the exchange drew criticism over a roughly 17-hour disclosure gap. On-chain investigator ZachXBT flagged suspicious activity before CoinDCX formally acknowledged the breach. The following day, co-founders Neeraj Khandelwal and Sumit Gupta confirmed the loss, said the attack affected only an operational account, and committed treasury funds to cover the shortfall.
In response, CoinDCX also reported the incident to CERT-In and launched a bounty offering up to 25% of recovered assets.
Ultimately, the case shows how attackers can use one compromised employee device to reach operational funds, even when an exchange separates customer custody from trading infrastructure. Moreover, it highlights the gap between on-chain detection and official communication. Although customers avoided a direct loss, the breach exposed the risks surrounding employee credentials and liquidity operations.
CoinDCX hack: incident details and company background
On July 18, 2024, attackers stole approximately $235 million from WazirX, making it the largest of the Indian crypto exchange hacks covered here. Specifically, the attack targeted a multisignature wallet within the exchange’s Safe and Liminal custody arrangement.
Following the breach, on-chain investigators and subsequent statements from U.S., Japanese, and South Korean authorities attributed the operation to North Korea’s Lazarus Group. Investigators cited indicators such as malicious contracts, Tornado Cash transactions, and laundering patterns associated with the group.
In response, WazirX suspended withdrawals and trading. It then proposed a controversial loss-sharing structure that would give users immediate access to roughly 55% of their holdings while locking or converting the remaining 45%.
However, users strongly opposed the proposal because it spread the shortfall across account holders, including those who held tokens that the attackers had not stolen. As a result, WazirX abandoned the 55-45 structure.
The recovery process subsequently shifted to a formal restructuring of Zettai Pte Ltd, WazirX’s Singapore entity, under Singapore’s Insolvency, Restructuring and Dissolution Act. Although the court rejected an initial proposal, creditors later approved an amended scheme with approximately 95.7% support by number and 94.6% by value.
Following that approval, the Singapore High Court sanctioned the scheme with modifications on October 13, 2025. The arrangement took effect shortly afterward.
Under the approved structure, users received roughly 85–85.5% of their claim value upfront in liquid crypto. Meanwhile, Recovery Tokens represented the remaining portion and linked potential repayments to future asset recoveries, platform profitability, and further seizures.
WazirX hack: incident details, restructuring, and recovery
Two earlier Indian crypto exchange hacks show how delayed or misleading disclosure can deepen investor losses.
First, in April 2018, Coinsecure lost 438 BTC, worth roughly $3–3.5 million at the time. At that point, only chief security officer Dr. Amitabh Saxena and CEO Mohit Kalra held the private keys to the main wallet.
Saxena reported the funds missing during an extraction process related to Bitcoin Gold. However, Coinsecure suspected an inside job, filed a police complaint, and urged authorities to seize his passport. The platform subsequently shut down.
Consequently, the case highlights the risks of concentrating wallet access among a small number of executives without stronger controls over transfers and key use.
Several years later, in February 2022, Bitbns suffered a roughly $7.5 million hot-wallet drain. The attackers moved funds through intermediate addresses and Tornado Cash. Meanwhile, the exchange described its downtime as “system maintenance.”
About a year later, in early March 2023, ZachXBT publicly connected the suspicious outflows with the maintenance announcement. Following those disclosures, CEO Gaurav Dahake acknowledged the compromise. In addition, users faced prolonged withdrawal delays.
Together, these incidents show that investors can suffer from both the initial theft and the information gap that follows. When an exchange withholds a clear explanation, users cannot assess their exposure or make timely decisions about their remaining funds.
Indian crypto exchange hacks represent only part of the country’s crypto losses. Beyond these breaches, Ponzi operators have attracted substantial sums through fixed-return promises, referral networks, and bull-market hype.
For example, Amit Bhardwaj and associates, including his brother Ajay, launched GainBitcoin around 2015. The scheme promised roughly 10% monthly returns through “cloud mining” contracts. To participate, investors bought Bitcoin elsewhere and deposited it with the operation.
The structure followed a familiar pattern: new deposits funded payouts to earlier participants. However, when inflows slowed, the operators shifted payouts to MCAP, an in-house token with far less value.
Meanwhile, estimates of GainBitcoin’s scale vary widely across media reports and agency statements. Some cite tens of thousands of crores, while others reference tens of thousands of Bitcoin. Following Bhardwaj’s death, authorities continued CBI and ED investigations and legal proceedings involving remaining associates. Authorities have also made multiple arrests.
Similarly, Divyesh Darji promoted Bitconnect’s India operations through seminars and referral networks that promised high monthly returns on Bitconnect Coin. After the global scheme collapsed, Indian investigators linked Darji to significant local fundraising.
Other schemes followed comparable playbooks. For instance, Morris Coin promoter Nishad K targeted investors, particularly in Kerala, with promises of high returns, a token launch, and an exchange listing. However, investigators alleged that the operation relied on a fake investment proposition. The case involved figures around ₹1,200 crore and ED asset attachments.
Likewise, Umesh Verma’s Pluto Exchange issued “Coin Zarus” and offered monthly returns of 20–30% before shutting down and leaving investors with losses.
Ultimately, these schemes exploited rising crypto prices to make unrealistic yields appear credible. In addition, referral commissions encouraged participants to recruit friends and family, expanding the losses beyond the original investors.
Not all Indian crypto exchange hacks involve stolen coins. In 2020–2021, data associated with BuyUCoin users appeared on dark-web forums. Researchers linked the material to the ShinyHunters group.
Reports initially cited roughly 325,000 records, while later estimates put the figure closer to 160,000. The reported fields included names, email addresses, phone numbers, encrypted passwords, wallet details, order histories, bank information, and KYC identifiers such as PAN numbers.
BuyUCoin initially described the material as dummy data from a testing exercise and denied any customer impact. It later said it would investigate.
Such leaks create risks beyond the exchange itself. Attackers can use personal information to craft convincing phishing messages, attempt SIM swaps, or test reused credentials across other services.
Consequently, a data breach can become the starting point for a later wallet or account theft. A message that includes a user’s real account details may appear credible even when a scammer sends it.
Across Indian crypto exchange hacks, attackers have repeatedly exploited weaknesses in human access and operational controls.
In CoinDCX’s case, a fake freelance opportunity allegedly persuaded an employee to install malware on a work laptop. The resulting credential compromise exposed an operational account. Consequently, the security question extends beyond wallet storage to employee permissions, device isolation, and transaction approvals.
Coinsecure illustrates a related problem: concentrated key control. Only the CEO and CSO held the main wallet’s private keys. However, concentrated access creates insider risk without proving that an insider committed the theft. Similarly, an attacker’s compromise of an employee device does not automatically establish employee collusion.
WazirX exposed weaknesses around multisignature transaction authorization. Multiple signatures offer limited protection if signers cannot reliably verify the action they approve. WazirX and Liminal disputed responsibility, so describing the incident simply as a confirmed smart-contract coding vulnerability overstates the available conclusions.
After a theft, laundering adds another obstacle. Attackers can split funds across wallets, swap assets, and use mixers such as Tornado Cash to complicate tracing. However, investigators must establish the actual sequence for each incident rather than assume that every hack follows an identical route.
Disclosure then determines how quickly users can assess their exposure. Bitbns’ maintenance explanation and CoinDCX’s reported 17-hour public disclosure gap illustrate different transparency failures.
Importantly, India already requires covered entities to report specified cyber incidents to CERT-In within six hours of noticing them or receiving notification. That requirement concerns reporting to the authority, rather than an equivalent public announcement to customers.
Together, these cases show why exchanges need layered controls across employee access, transaction verification, fund movement, and customer communication.
India taxes income from crypto transfers at 30%, with applicable surcharge and cess. Its tax framework also restricts loss offsets and carry-forwards. Separately, qualifying transactions attract 1% TDS, subject to applicable thresholds and conditions. The rule does not apply indiscriminately to every crypto movement.
These rules affect trading costs and cash flow. However, they do not establish custody standards or demonstrate that taxation causes users to concentrate their holdings on fewer exchanges.
Meanwhile, India requires virtual-asset service providers serving Indian users to register with FIU-IND and meet anti-money-laundering obligations. Exchanges therefore operate under more than ordinary business registration. Nevertheless, FIU registration does not provide a comprehensive exchange licence or guarantee customer protection.
The security gap concerns consistent, enforceable standards across custody, independent assurance, customer-asset segregation, and accountability after a failure.
Platforms make many operational choices themselves. Some publish proof of reserves, appoint institutional custodians, or maintain protection funds. However, users must examine what those arrangements cover and how independent parties verify them.
For example, reserve disclosures alone cannot establish an exchange’s solvency. Users also need information about liabilities, asset ownership, and restrictions on withdrawals.
Likewise, outsourcing custody does not remove every risk. Exchanges still need secure authorization workflows, restricted employee access, and clear responsibilities between service providers.
Ultimately, external attackers and dishonest operators exploit different weaknesses, but both benefit when users cannot assess a platform’s controls or financial position.
First, victims should preserve transaction hashes, wallet addresses, account statements, payment records, and communications. These records help investigators connect the initial deposit with subsequent fund movements.
Next, users who suspect financial cyber fraud can report promptly through India’s cybercrime reporting channels and approach the appropriate police unit to seek an FIR. Additionally, where evidence suggests money laundering, they can provide relevant information to the Enforcement Directorate.
Local police, the CBI, and the ED handle different aspects of crypto cases according to their jurisdiction and authority. Meanwhile, overseas exchanges, foreign authorities, and custody providers may need to cooperate when funds cross borders.
Alongside criminal investigations, civil proceedings can offer another route to seek recovery or asset-freezing orders. However, an arrest or attachment does not automatically produce immediate repayment for victims.
Alternatively, the WazirX case illustrates court-supervised restructuring. Proceedings involving its Singapore entity created a framework for partial distributions and a platform restart. Nevertheless, such arrangements depend on the relevant company, available assets, creditor participation, and court approval.
Furthermore, cross-border transfers and mixer transactions can complicate recovery. Investigators may identify a fund trail without securing immediate control over the assets.
Finally, India lacks a national crypto-specific investor compensation fund that automatically covers exchange hacks or failures. Consequently, victims often depend on investigations, litigation, asset recoveries, or restructuring distributions.
To begin with, self-custody can reduce exchange exposure for long-term holdings, provided users manage their keys and backups securely. Hardware wallets keep signing keys offline, but users must still verify transactions and protect their recovery phrases.
For exchange activity, maintain only the balance you need for trading and withdraw surplus holdings. Before depositing, examine the platform’s reserve disclosures, liabilities, custody arrangements, and withdrawal record.
In addition, check what any protection fund or insurance policy actually covers. A platform’s security claims do not necessarily guarantee reimbursement after a breach.
Equally, verify official URLs carefully, particularly when search results, advertisements, or direct messages lead you to an exchange login page. Fake CoinDCX and other exchange websites have targeted users.
To strengthen account security further, enable strong two-factor authentication wherever available. Prefer an authenticator app or hardware security key over SMS, and use a unique password for each account.
Additionally, treat unsolicited job offers, Telegram freelance assignments, and requests to install unfamiliar software as warning signs. The CoinDCX case shows how attackers can turn a seemingly unrelated work opportunity into access to crypto infrastructure.
Finally, after a personal-data leak, watch for unexpected password resets, mobile-network disruptions, and messages that reference genuine account information. Those details can help attackers make a fraudulent request look legitimate.
India already applies taxation, anti-money-laundering obligations, and cyber-incident reporting requirements to relevant crypto activities. However, those measures serve different purposes and do not collectively guarantee safe custody or investor compensation.
For example, FIU registration focuses on financial-crime compliance. Similarly, reporting an incident to CERT-In does not itself give customers timely information about withdrawal restrictions, losses, or repayment plans.
By comparison, Pakistan’s 2025 initiative developed into the Virtual Assets Act 2026, under which PVARA oversees the sector. The authority’s framework requires virtual-asset service providers to obtain licences and also provides routes for sandbox participation.
Against this backdrop, India’s exchange framework would need to connect market access with enforceable operational standards. Independent security reviews could test controls, while customer-asset segregation and clear custody responsibilities could reduce misuse.
Additionally, reserve and liability disclosures could improve financial transparency. Meanwhile, explicit customer-notification deadlines could address the gap between reporting a breach to authorities and explaining its consequences to users.
Beyond these operational safeguards, any investor-protection mechanism would need clear funding, eligibility, and payout rules. Otherwise, users could mistake a voluntary protection fund for guaranteed coverage.
Ultimately, regulation cannot eliminate social engineering or signing errors. Nevertheless, enforceable standards can reduce preventable failures, assign responsibility, and improve the process that follows a breach.
Timeline of major Indian crypto exchange hacks and scams
These Indian crypto exchange hacks span more than seven years and several distinct attack methods. However, the same weaknesses repeatedly surface: concentrated access, vulnerable operational processes, poor disclosure, and uncertain recovery routes.
For crypto investors, the practical lesson remains clear. Assess custody and withdrawal risks alongside trading fees and token listings. A platform’s popularity does not guarantee that its controls can withstand an attack or that it can repay users afterward.
This article is investigative reporting, not financial advice.
