Indian cryptocurrency exchange CoinDCX has reported a major security breach resulting in a loss of approximately ₹378 crore ($44.2 million). The incident, which took place on July 19 at 4 am IST, involved unauthorized access to an internal operational account on a partner exchange. The company has assured users that their funds remain secure and unaffected.
In a FIR released on Sunday, CoinDCX said that the full financial impact is being absorbed by the company’s treasury reserves, with no losses passed on to customers. Co-founders Sumit Gupta and Neeraj Khandelwal addressed the situation on the social media platform X, attributing the breach to a “sophisticated server attack” targeting an internal wallet used for liquidity provisioning.
“Today, one of our internal operational accounts - used only for liquidity provisioning on a partner exchange - was compromised due to a sophisticated server breach. I confirm that the CoinDCX wallets used to store customer assets are not impacted and are completely safe. This won’t cause any loss to our customers. CoinDCX will be bearing the full amount,” Gupta posted.
Khandelwal added, “The total amount lost was ₹378 crore ($44 million) out of our treasury assets. CoinDCX Treasury will be bearing these losses.”
{{/usCountry}}Khandelwal added, “The total amount lost was ₹378 crore ($44 million) out of our treasury assets. CoinDCX Treasury will be bearing these losses.”
{{/usCountry}}The incident was first flagged by blockchain investigator ZachXBT, after which CoinDCX made the breach public. However, the delay of nearly 17 hours before disclosure has sparked criticism online, even as many commended the company’s decision to protect user assets.
Following the news, a rush of withdrawal requests overwhelmed CoinDCX’s systems, causing its portfolio APIs—which display user balances and transaction histories—to become temporarily unresponsive. Many users were unable to view their holdings for several hours, fueling speculation and anxiety across platforms. The company later confirmed that the APIs have been restored.
CoinDCX stated that the affected infrastructure has been completely isolated, and platform operations are functioning normally. Trading activities, INR deposits, and withdrawals continue without disruption. The company clarified that INR withdrawals below ₹5 lakh will be processed within 5 hours, while those above ₹5 lakh will be completed within 72 hours.
CoinDCX has reported the breach to the Indian Computer Emergency Response Team (CERT-In) and initiated forensic investigations in collaboration with two globally reputed cybersecurity firms. The company has committed to sharing its findings publicly.
The breach follows a major hack in 2024 at Indian exchange WazirX, which resulted in losses of over ₹1,965 crore (USD 230 million) - the largest of its kind in India to date.
Reactions on social media have been mixed. One user commented, “CoinDCX silent for 17 hours? That's more suspense than a thriller! In crypto, transparency isn't optional; it's key. Stay open to keep trust alive!” Another wrote, “Good to see CoinDCX acting responsibly, assuring user funds are safe, and not passing losses onto customers. Sets a positive precedent for Indian crypto exchanges.”