CoinDCX (India): about USD 44M drained from an...

What happened

CEO Sumit Gupta disclosed on Saturday 19 Jul 2025 that an internal account “used only for liquidity provisioning on a partner exchange” was compromised. ZachXBT put the loss at about USD 44.2M; CoinDCX said the funds were consolidated into 4,443 ETH and 155,830 SOL; the attacker address was funded with 1 ETH from Tornado Cash. Customer funds were unaffected and the loss was absorbed from treasury reserves (TechCrunch). The breach began at 2:37 AM with a 1 USDT test transfer (Inc42).
Root cause per Bengaluru police: attackers posing as recruiters used a part-time job offer to get malware onto software engineer Rahul Agarwal’s company laptop, and his credentials were used to access systems and move funds (The Block; Inc42). Gupta called it “a sophisticated social engineering attack”.
Attacker: not established; investigators are probing whether foreign actors were involved (The Block).
Response: Agarwal was arrested on a complaint by operator Neblio Technologies; he denies involvement but admitted freelance work against company policy. CoinDCX offered a 25% recovery bounty and works with CERT-In and partner exchanges. The later Oct 2026 loss from the same compromised wallets is in gap_crypto.md.