Indian cryptocurrency exchange CoinDCX suffered a significant cyberattack on Saturday, July 19, 2025, resulting in the theft of approximately $44.2 million from one of its internal operational accounts. The incident, which came to light through the efforts of blockchain sleuth ZachXBT and security firm Cyvers, has raised concerns within the crypto community.

CoinDCX CEO Sumit Gupta and Co-founder Neeraj Khandelwal swiftly confirmed the breach. Gupta clarified that the compromised account was exclusively used for liquidity provisioning on a partner exchange, emphasizing that "No customer funds have been impacted. Your assets remain completely safe and protected in our secure cold wallet infrastructure." Khandelwal further confirmed the exact loss amount, stating, "The total amount lost was ~$44Mn out of our treasury assets. CoinDCX Treasury will be bearing these losses." He added that the company's primary objective was to secure assets before making a public announcement.

Photo Credit: Pinterest

The attack was described as a "sophisticated server breach." Investigations revealed that the attacker initiated the breach with a small amount of Ethereum from Tornado Cash, a privacy-focused mixer, and subsequently bridged a portion of the stolen funds from the Solana blockchain to the Ethereum network, demonstrating advanced cross-chain capabilities. CoinDCX acted quickly to contain the incident by isolating the affected operational account to prevent further spread.

In response to the attack, CoinDCX has assured its users that all trading activity and INR withdrawals remain fully operational, although trading in the Web3 section was temporarily paused as a safety measure. The exchange has engaged cybersecurity experts to investigate the matter, patch vulnerabilities, and trace the movement of funds. CoinDCX plans to collaborate with its exchange partner to block and recover assets and will soon launch a bug bounty program to aid in the recovery process.

Photo Credit: Pinterest

This incident marks the second major cyberattack on an Indian crypto exchange in roughly a year, following the $230-235 million hack of WazirX in July 2024. The CoinDCX breach also occurs amidst a wave of recent crypto hacks globally, including a politically motivated $81 million attack on Iranian exchange Nobitex, a $42 million exploit on GMX V1 (partially recovered), and an $8.3 million loss for the Bitcoin DeFi platform Alex Protocol. These incidents highlight the ongoing challenges and sophisticated threats faced by cryptocurrency platforms in securing digital assets, underscoring the critical need for enhanced security protocols and increased vigilance in the evolving regulatory landscape.