CoinDCX Engineer Arrested in $44M Crypto Theft Probe

A CoinDCX employee, Rahul Agarwal, has been arrested in Bengaluru in connection with a $44 million cryptocurrency theft, with evidence suggesting his credentials were compromised by hackers [1]. The breach occurred on July 19, 2025, when funds were siphoned from an internal liquidity account, with the stolen assets transferred to six crypto wallets. Forensic investigations are ongoing to determine the exact method of intrusion and identify the hackers' entry point [1].

Agarwal, a software engineer with the company, was identified following an internal probe that uncovered a Rs 15 lakh deposit in his personal account with no clear source. He claimed the funds were from freelance work, but this has not yet resolved suspicions about his role in the breach [2]. The compromised credentials were traced to his work laptop, which was also reportedly used for external freelance activities, highlighting potential lapses in internal access controls [2].

In response to the incident, CoinDCX’s parent company, Neblio Technologies, confirmed the breach and pledged to cover the $44 million loss from its own reserves. This action has helped reassure users that their funds remain unaffected, distinguishing this case from the 2024 WazirX breach where customer assets were directly impacted [1].

Cybersecurity experts have described the incident as a critical warning for the cryptocurrency industry. The case highlights vulnerabilities in endpoint security and credential management—issues previously flagged by a 2023 NIST study on financial system risks. Despite such warnings, many firms appear to remain unprepared for targeted attacks of this scale [1].

The breach has also sparked broader concerns about employee behavior, training, and access control policies in the fast-growing crypto sector. CoinDCX has announced a full review of its security protocols, but the case underscores the urgent need for enhanced internal safeguards and greater transparency in asset management [2].

Law enforcement is currently investigating whether Agarwal acted alone or as part of a larger operation. Authorities are also assessing whether similar tactics were used in other breaches. Given CoinDCX’s status as one of India’s largest cryptocurrency exchanges, the outcome of this case could have significant legal and operational implications for the industry [1].

Sources:

[1] NDTV - Latest News, Photos, Videos on Arrest (https://www.ndtv.com/topic/arrest)

[2] NDTV - Latest News, Photos, Videos on Moves (https://www.ndtv.com/topic/moves)