How Hackers Looted $44M From CoinDCX

In a dramatic turn for India’s crypto scene, CoinDCX one of the country’s largest exchanges confirmed a $44 million breach in July 2025. Unlike the smart contract exploits that usually grab headlines, this hack didn’t involve complex blockchain tricks. Instead, it was a surgical strike on backend infrastructure, and it exposed an uncomfortable truth: infrastructure, not crypto protocols, might be the industry’s weakest link.

What Happened: A Quick Recap

The breach occurred between July 16 and 19, but it wasn’t until blockchain investigator ZachXBT flagged suspicious transactions on his Telegram channel that the hack became public knowledge. Within minutes, over $44 million in crypto mostly USDT, SOL, and ETH—had been drained from an internal operational wallet.

CoinDCX CEO Sumit Gupta responded hours later on X assuring users that all customer funds remained untouched, thanks to segregated cold wallets. But the damage to trust was already done.

Anatomy of the Attack

So, how did hackers pull this off?

According to CoinDCX’s post-incident report and independent blockchain analysis, the attackers compromised backend infrastructure, likely via exposed credentials or server access not through blockchain exploits.

It started with 1 ETH sent through Tornado Cash, a popular crypto mixer used to hide transaction origins. The attacker then bridged funds across Solana and Ethereum, moving money in chunks of 1,000–4,000 SOL. Within five minutes, the operational wallet was empty.

Interestingly, the breach included a test transaction of just $1 a few days before the main attack proof of a carefully planned operation, not a random exploit.

More from TechCrunch on the breach

CoinDCX’s Response

Once the breach was discovered, CoinDCX isolated the compromised account, halted Web3 withdrawals, and began working with cybersecurity firms and law enforcement agencies including CERT-In and blockchain partners like Wormhole and Solana Foundation.

In a bold move, the company launched a bounty program offering 25% of any recovered funds, potentially up to $11 million, to researchers or white-hat hackers who help trace or retrieve the stolen assets.

Gupta reiterated that the firm remains financially healthy, with over $100 million in treasury reserves. Trading and INR operations remained fully functional throughout.

Transparency Under Fire

Despite CoinDCX’s assurances, the community wasn’t happy with the 17-hour silence following the breach.

The company claims it needed time to verify facts before going public. But critics argue that a platform built on promises of transparency should have informed users sooner especially after similar complaints were leveled during past incidents like the Bybit hack in March.

One user commented, “If it wasn’t for ZachXBT, would we even know about this yet?”

A Pattern Emerges: July’s Crypto Curse?

Strangely, this isn’t India’s first major July breach. Exactly one year ago, WazirX suffered a $235 million hack, also linked to backend vulnerabilities and North Korea’s Lazarus Group the same group now suspected in the CoinDCX attack.

Two years. Two breaches. Same month.

And in both cases, the attacks were not on the blockchain, but on centralized infrastructure.

India’s Hot Wallet Problem

CoinDCX isn’t alone. Most Indian exchanges WazirX, CoinSwitch, and others still rely heavily on hot wallets to provide liquidity. These wallets, connected to the internet, are convenient for real-time trading but high-risk for security.

In contrast, cold wallets offer much stronger protection but introduce latency issues, frustrating users during high-volume periods.

Some platforms like Giottus have adopted conservative cold wallet strategies, avoiding major breaches but often at the cost of slower withdrawals and user complaints.

What Users Should Take Away

• Use Self-Custody: Hardware wallets like Ledger or Trezor keep your funds safe even if an exchange is breached.
• Follow Blockchain Analysts: Independent investigators often spot suspicious activity before exchanges confirm anything.
• Spread Risk: Don’t store all your crypto on a single platform, especially without proof-of-reserves.
• Demand Better: Transparency, audits, and incident response protocols should be non-negotiable for any exchange you trust.

Final Thoughts

The $44 million CoinDCX hack wasn’t the largest crypto theft ever but it’s one of the most revealing. It shows that even well-funded, regulated platforms can be blindsided if backend infrastructure is left exposed.

The company deserves credit for containing the breach and protecting customer funds. But the incident is a wake-up call for India’s entire crypto ecosystem: real security isn’t just about cold wallets it’s about culture, transparency, and readiness.

Until Indian exchanges close the gap with global standards, users must stay vigilant.