CoinDCX Employee Arrested in $44M Crypto Theft via Compromised Server Access

Late July 2025 saw the arrest of Rahul Agarwal, a CoinDCX employee, in connection with a $44 million cryptocurrency theft that has become one of the largest cybercrime incidents in India’s crypto sector. The breach involved the unauthorized siphoning of funds through a server compromise that gave hackers access to one of the exchange’s operational wallets [1]. According to investigations, Agarwal’s login credentials were exploited, enabling the hackers to move the funds to six separate accounts [2]. The compromised account was used for liquidity provisioning with an external platform and was swiftly isolated after the breach was discovered [3].

The incident, which occurred on an Indian-issued laptop used by Agarwal for freelance work, has raised serious concerns about internal cybersecurity practices at crypto exchanges. Police have cited evidence of potential insider involvement, though whether Agarwal was a willing accomplice or an unwitting victim remains under investigation [4]. The stolen digital assets were moved quickly across multiple accounts, further complicating recovery efforts [5].

CoinDCX CEO Sumit Gupta has confirmed that the breach did not affect user wallets or customer assets. The exchange has stated that the losses will be absorbed from its own treasury reserves. Despite the incident, Gupta has denied rumors of a potential acquisition by Coinbase and reiterated that CoinDCX is not for sale [3].

The case has intensified the debate around security measures in the fintech and crypto sectors. Analysts and industry observers stress the importance of robust internal controls, employee access monitoring, and stricter safeguards to prevent similar breaches [6]. The incident also raises broader legal and regulatory questions about the recovery and prosecution of digital asset theft in India. Media coverage has been widespread, with the case likely to influence future security protocols and compliance standards across the industry [7].

Sources:

[1] https://indianexpress.com/article/cities/bangalore/hackers-wipe-rs-384-crore-bengaluru-cryptocurrency-neblio-technologies-10159263/lite/

[2] https://cryptonews.com/news/coindcx-staff-held-for-44m-heist-hackers-exploited-login-credentials/

[3] https://www.ndtv.com/india-news/hackers-steal-rs-380-crore-in-cryptocurrency-from-coindcx-employee-arrested-44-million-8983261

[4] https://www.cnbctv18.com/market/cryptocurrency/coindcx-crypto-theft-what-we-know-so-far-19646316.htm

[5] https://www.etvbharat.com/en/!bharat/fraudsters-steal-cryptocurrency-worth-rs-380-crore-from-bengaluru-crypto-exchange-firm-enn25073004427

[6] https://timesofindia.indiatimes.com/india/bengaluru-techie-held-for-rs-379-crore-crypto-theft-in-his-company/articleshow/123006349.cms

[7] https://www.news18.com/business/cryptocurrency/coindcx-44-million-crypto-heist-bengaluru-police-probe-insider-involvement-employee-arrested-9473656.html