Indian cryptocurrency exchange CoinDCX has reported a major security breach resulting in the theft of USD 44.2 million (approximately Rs 378 crore). The company confirmed the incident involved an internal operational account and assured users that customer assets remain completely safe and unaffected.
In a First Incident Report released on Sunday, CoinDCX disclosed that the breach was detected in the early hours of July 19, around 4 am IST.
The compromise involved unauthorised access to one of its accounts on a partner exchange, triggering a financial exposure of over $44 million. The platform clarified that the loss is being absorbed entirely by CoinDCX’s treasury reserves and will not impact user holdings.
“This was a sophisticated server breach targeting an internal wallet used solely for liquidity provisioning on a partner exchange,” said Sumit Gupta, co-founder of CoinDCX, in a post on X (formerly Twitter).
“Customer wallets remain secure, and no user funds are at risk. CoinDCX will bear the full extent of the loss.”
Following the announcement, the platform witnessed a surge in user activity, as concerned customers logged in to verify their balances.
This sudden spike led to temporary outages in CoinDCX’s Portfolio APIs, rendering many users unable to view their balances or transaction histories for several hours. The APIs have since been restored.
CoinDCX said that all impacted infrastructure has been isolated and that core services, including trading, INR deposits, and withdrawals, remain fully functional. INR withdrawals under Rs 5 lakh will be processed within 5 hours, while larger withdrawals will be completed within 72 hours, the company added.
India’s cyber watchdog, the Indian Computer Emergency Response Team (CERT-In), has been notified.
CoinDCX also confirmed that two leading global cybersecurity agencies have been engaged to conduct a forensic investigation, with full reports to be shared publicly.
(With inputs from PTI)