Indian Exchange CoinDCX hacked?

[Bitcoin Smith]

The attacker address was funded with 1 ETH from Tornado Cash and later bridged a portion of the stolen funds from Solana to Ethereum.

H/t Cyvers (https://x.com/cyversalerts) for flagging the withdrawals to me. The affected CoinDCX hot wallet is not publicly tagged or in current proof of reserves so I had to manually attribute it via reviewing counterparties.

Theft address
6peRRbTz28xofaJPJzEkxnpcpR5xhYsQcmJHQFdP22n (https://solscan.io/account/6peRRbTz28xofaJPJzEkxnpcpR5xhYsQcmJHQFdP22n)
3btch8cSVp3Uh2SiY9DeiRNYUBmFiBNHZQzDyecJs7Gu (https://solscan.io/account/3btch8cSVp3Uh2SiY9DeiRNYUBmFiBNHZQzDyecJs7Gu)
0xEF0c5b9E0E9643937D75C229648158584A8CD8D2 (https://etherscan.io/address/0xef0c5b9e0e9643937d75c229648158584a8cd8d2)

No official report from the exchange CoinDCX but this is posted on ZachXBT's official telegram channel and people created threads that their withdrawals are pending so it can't be a coincidence. Another point to note Wazirx got hacked in July 18th 2024 (biggest Indian exchange at that time) and exactly one year later CoinDCX hacked on July 18th 2025 if we just add the 17 hours before into the calculations so it's not just a random attack, someone is trying to make a point?

I already posted about this in my local board but just wanted to share it with everyone and it might works as reminder for the community to not to store your cryptos in exchanges, you can just lose all your funds just like that and you may never get them back on most occasinos.

#Not Your Keys Not Your Cryptos

[OmegaStarScream]

This was just posted by the CEO:

.....
Before I share further details on this, I would like to highlight that:
-No customer funds have been impacted
-Your assets remain completely safe and protected in our secure cold wallet infrastructure
-All trading activity and INR withdrawals are fully operational

It's good news that operations have not been affected, but this is definitely not an exchange I would recommened anyone to use. Making a statement about the hack 17 hours after the incident is not a good look.

[Merit.s]

This topic does not belong here but in the exchange board https://bitcointalk.org/index.php?board=53.0. You can move the topic there OP.

Storing your coins in an exchange is what many forum members here have kicked against because of the risk attached to it. Since cryptocurrency exists, exchanges 3ill always be a target for scammers which means that you can lose your funds at anytime. Secondly, you are not in control of your funds and they control your funds for you and can choose to deprive you from your funds.

Centralized exchange will say that customers funds are SAFU which there is no one to confirm that. However, coinDCX has taken full responsibility of the hack and customers funds are intact. This is good news.

Another warning to those who see exchange as a safe place to store their coins. Be in self custody of your coins and sleep like a new born baby without any worries or panic.

[Amphenomenon]

This was just posted by the CEO:

.....
Before I share further details on this, I would like to highlight that:
-No customer funds have been impacted
-Your assets remain completely safe and protected in our secure cold wallet infrastructure
-All trading activity and INR withdrawals are fully operational

It's good news that operations have not been affected, but this is definitely not an exchange I would recommened anyone to use. Making a statement about the hack 17 hours after the incident is not a good look.

As always they want to try everything to keep a good reputation but sometimes fail to ignore the importance of transparency. Imagine ZachXBT didn't review this? Maybe they could have hidden it for a longer time after all their customers could still access their funds as they stated in their post.

It's better ti avoid CEX but when there's no other feasible option, I rather opt for top/well known and who are more transparent and their behaviour doesn't make one prune to scammers.

[Bitcoin Smith]

This was just posted by the CEO:

.....
Before I share further details on this, I would like to highlight that:
-No customer funds have been impacted
-Your assets remain completely safe and protected in our secure cold wallet infrastructure
-All trading activity and INR withdrawals are fully operational

It's good news that operations have not been affected, but this is definitely not an exchange I would recommened anyone to use. Making a statement about the hack 17 hours after the incident is not a good look.

I won't trust their statements anymore for two reasons,

1. They accepted the incident only after they were exposed which is clearly a red flag.
2. INR withdrawals are pending that's reported by many users from reddit community.

All I can hope is this doesn't turn out to be another one like Wazirx who can't operate anymore once the 230 million worth of funds wiped by Lazarus group.

[Bitcoin_Arena]

This was just posted by the CEO:

.....
Before I share further details on this, I would like to highlight that:
-No customer funds have been impacted
-Your assets remain completely safe and protected in our secure cold wallet infrastructure

It's good news that operations have not been affected, but this is definitely not an exchange I would recommened anyone to use. Making a statement about the hack 17 hours after the incident is not a good look.

No customer funds have been impacted. Wow, so the $44.2M generally came out of a thin air. It's funny to claim that user assets are completely safe and protected in secure wallets yet 17 hours earlier, $44M was moved out with ease. These crypto exchange CEOs really love to take people some for a ride.

If I was one of the users, I would me moving my funds as fas as possible.

[avp2306]

This was just posted by the CEO:

.....
Before I share further details on this, I would like to highlight that:
-No customer funds have been impacted
-Your assets remain completely safe and protected in our secure cold wallet infrastructure
-All trading activity and INR withdrawals are fully operational

It's good news that operations have not been affected, but this is definitely not an exchange I would recommened anyone to use. Making a statement about the hack 17 hours after the incident is not a good look.

I won't trust their statements anymore for two reasons,

1. They accepted the incident only after they were exposed which is clearly a red flag.
2. INR withdrawals are pending that's reported by many users from reddit community.

All I can hope is this doesn't turn out to be another one like Wazirx who can't operate anymore once the 230 million worth of funds wiped by Lazarus group.

Also they stated out here https://walletinvestor.com/magazine/coindcx-hack-exposes-44m-loss-as-ethereum-trail-emerges that they plan to have a bug bounty program soon.

If they are serious dealing with this issue they should act as fast as they can.

Many people got suspicious the way they handle the situation so hopefully they are not doing anything illegal out there and just use the hack reason so they can exit easily with those funds stolen on that exchange. As what other people said if I am the user of that exchange I will move my coins on top exchange and stop using CoimDCX while they are facing huge issue.

[condoras]

No customer funds have been impacted. Wow, so the $44.2M generally came out of a thin air. It's funny to claim that user assets are completely safe and protected in secure wallets yet 17 hours earlier, $44M was moved out with ease. These crypto exchange CEOs really love to take people some for a ride.

If I was one of the users, I would me moving my funds as fas as possible.

I still can't understand how those funds were stolen and from where. If the customer's funds weren't affected, then whose coins belong to?
It's obvious that their CEO states something like that, because he and his exchanger will face massive withdrawal requests.

As what other people said if I am the user of that exchange I will move my coins on top exchange and stop using CoimDCX while they are facing huge issue.

Most of the time that an exchanger faces hack issues, their volume, thus their clients, gets as far away as they can. It's more than difficult to rewind this and be back on track.

[tabas]

I still can't understand how those funds were stolen and from where. If the customer's funds weren't affected, then whose coins belong to?
It's obvious that their CEO states something like that, because he and his exchanger will face massive withdrawal requests.

They won't discuss how the exploit happens but it's good to hear that the CEO himself confirms that there's an actual hack that has happened. If he tells that no customer funds were affected, it's either half baked truth because it's not just their funds that are affected there to give guarantee their customers. It's just a way to calm their users so that there won't be massive withdrawals but, even if he say that, batches of withdrawals coming every hack happens.

[Bitcoin Smith]

because he and his exchanger will face massive withdrawal requests.

It's happening already, even though they haven't disabled the withdrawal features they just kept it under the tab processing with no reply from the customer support when then the usual withdrawal time will be no more than 30 minutes. So definitely something is happening.

And they are saying yes we lost the money but your money is safe with us without disclosing any details but they ran live Q&A to keep the users with their platform and I don't know WTF they are thinking.

[joniboini]

And they are saying yes we lost the money but your money is safe with us without disclosing any details but they ran live Q&A to keep the users with their platform and I don't know WTF they are thinking.

If we assume they're telling the truth, maybe they're in the process of moving their cold wallet funds to cover the withdrawal requested from the customers, hence why the longer withdrawal time happens. If that's not the case, maybe they're trying to contact other institutions to help them cover the cost to reduce the panic of their customer. Worst case scenario is that the management is not prepared for something like this, and they don't have any solutions so they're just trying to pretend everything is okay and hope for the best. CMIIW.

[libert19]

because he and his exchanger will face massive withdrawal requests.

It's happening already, even though they haven't disabled the withdrawal features they just kept it under the tab processing with no reply from the customer support when then the usual withdrawal time will be no more than 30 minutes. So definitely something is happening.

In their incident report [1] — they have mentioned it can take upto 72 hours to process withdrawal requests, so users should wait at least until then, if withdrawal is not received by then, then jump to conclusions.

No Halt in Withdrawals, Operations Running Normally

CoinDCX services remain fully operational. Trading activity, INR deposits and INR withdrawals continue. INR withdrawals below ₹5 lakhs will reflect in your account within 5 hours, while withdrawals above ₹5 lakhs will be processed within 72 hours. The incident was isolated and has no impact on your portfolio access or operations.

[condoras]

In their incident report [1] — they have mentioned it can take upto 72 hours to process withdrawal requests, so users should wait at least until then, if withdrawal is not received by then, then jump to conclusions.

No Halt in Withdrawals, Operations Running Normally

CoinDCX services remain fully operational. Trading activity, INR deposits and INR withdrawals continue. INR withdrawals below ₹5 lakhs will reflect in your account within 5 hours, while withdrawals above ₹5 lakhs will be processed within 72 hours. The incident was isolated and has no impact on your portfolio access or operations.

Their clients/ customers needed 72 hours before this incident to withdraw their funds, or did they create/apply it after the incident? If it's something "new", then we all understand their issue with withdrawals. And this time frame is only for fiat currencies or affects crypto as well? Cause fiat withdrawals are different from crypto ones.

[libert19]

...

Their clients/ customers needed 72 hours before this incident to withdraw their funds, or did they create/apply it after the incident?

This measure is applied after incident, I have used the exchange before, I'd receive amount in my bank account minutes after making withdrawal request.

If it's something "new", then we all understand their issue with withdrawals. And this time frame is only for fiat currencies or affects crypto as well? Cause fiat withdrawals are different from crypto ones.

That timeframe only applies to fiat withdrawals. Crypto withdrawals went live only recently and to limited number of users [1], no idea how long they take.


[1] https://x.com/CoinDCX/status/1947625176008687787

[condoras]

This measure is applied after incident, I have used the exchange before, I'd receive amount in my bank account minutes after making withdrawal request.

That timeframe only applies to fiat withdrawals. Crypto withdrawals went live only recently and to limited number of users [1], no idea how long they take.

[1] https://x.com/CoinDCX/status/1947625176008687787

It's more than clear that they have an issue with almost anything related to moving funds of any form, and it's very logical. However, some things like this one sound strange: "Crypto withdrawals are live for 10,000+ users today, with a phased rollout in the future to the wider community to ensure maximum security".
Why only 10k clients? What happened with the others? What's a "phase rollout", and how much time is their future? Ensuring maximum security...

[cryptomaniac_xxx]

There is some kind of update regarding CoinDCX



https://x.com/WuBlockchain/status/1949989028184608965

So it was leaked the Coinbase is in talks with CoinDCX for a take over.

Although it will be a big discount as they have been valued  $2.2 billion peak three years ago. Let's see how it goes, we all know how big Indian market is and most likely this is what Coinbase want to, cornering that side of the planet and them and Binance are really fighting it out in that region.

[condoras]

There is some kind of update regarding CoinDCX



https://x.com/WuBlockchain/status/1949989028184608965

So it was leaked the Coinbase is in talks with CoinDCX for a take over.

Although it will be a big discount as they have been valued  $2.2 billion peak three years ago. Let's see how it goes, we all know how big Indian market is and most likely this is what Coinbase want to, cornering that side of the planet and them and Binance are really fighting it out in that region.

I don't know if this is solid and reliable news, but if it is, then it will be a very good strategic move from Coinbase. India and the further region, considered a high-potential volume market, and acquiring an existing exchange seems cheaper than creating a new one. Especially after the hacking incident. I guess that Coinbase had searched this incident thoroughly before even considering making an offer.

[Bitcoin Smith]

I don't know if this is solid and reliable news, but if it is, then it will be a very good strategic move from Coinbase. India and the further region, considered a high-potential volume market, and acquiring an existing exchange seems cheaper than creating a new one. Especially after the hacking incident. I guess that Coinbase had searched this incident thoroughly before even considering making an offer.

At first CEO replied on the official X page as response to the above news as

”Ignore the rumours! CoinDCX is ‘super focused’ on building for India’s crypto story and not up for sale,” Gupta wrote. ”Will share more later but just wanted to clarify this upfront!”

But I tried looking for the tween now and it's deleted, so is it real?

AFAIK, Coinbase is already progressing with FIU compliance for a while and reported documentation process a few months back but there's no update in the recent times from Coinbase so I guess it's not in their priority list for now.

[Darker45]

~snip~

At first CEO replied on the official X page as response to the above news as

”Ignore the rumours! CoinDCX is ‘super focused’ on building for India’s crypto story and not up for sale,” Gupta wrote. ”Will share more later but just wanted to clarify this upfront!”

But I tried looking for the tween now and it's deleted, so is it real?

AFAIK, Coinbase is already progressing with FIU compliance for a while and reported documentation process a few months back but there's no update in the recent times from Coinbase so I guess it's not in their priority list for now.

The tweet is still there. It wasn't deleted.


https://x.com/smtgpt/status/1950028878946156605

I suspect there was a legitimate offer from Coinbase. The official response was probably not outright rejection. Perhaps it was along the line of "convince me more".

Or perhaps Coinbase is a little persistent making offers after offers despite the negative response from CoinDCX. That's how some companies absorb each other, anyway. It's not always smooth courting.

Unfortunately, for Coinbase, CoinDCX's hack wasn't fatal. They could easily recover from it. And the market potential

[condoras]

The tweet is still there. It wasn't deleted.


https://x.com/smtgpt/status/1950028878946156605

I suspect there was a legitimate offer from Coinbase. The official response was probably not outright rejection. Perhaps it was along the line of "convince me more".

Or perhaps Coinbase is a little persistent making offers after offers despite the negative response from CoinDCX. That's how some companies absorb each other, anyway. It's not always smooth courting.

Unfortunately, for Coinbase, CoinDCX's hack wasn't fatal. They could easily recover from it. And the market potential

Since Coinbase never replies to these rumours about making an offer, perhaps it was just a case of fake news. Whether to boost CoinDCX's reputation or the opposite depends on which side wants such news to "leak". However, we don't know with any certainty because both of them have very good reasons and gains for doing it. I guess at some point, history will tell.