I think they have calculated the figure based on the number of accounts Indian exchange have registered with them. A user can have multiple accounts with an exchange. KYC can be done using multiple IDs. For example: Fathers ID, Mothers ID, Brothers ID and ID of actual user. As long as the documents are correct Indian exchanges will clear KYC. The actual figure can be found out based on the data of bank accounts recieving funds from exchanges. 10 crore is a big number and you cannot rely on information provided by the Indian media outlets.
That's quite possible that users have used different mobile phone and used their family member's documents to buy and store cryptos. We Indians are good at such tasks and we often do such things. But in a country of 70 crore internet users, the number of crypto holder looks quite huge and hard to digest.
But I sincerely hope that the government takes notice of this statistics and instead of depriving 10 crore cryptocurrency users, brings favorable legislation.