CoinDCX Engineer Arrested in $44M Crypto Theft Scandal

A software engineer at CoinDCX, Rahul Agarwal, has been arrested by Bengaluru police in connection with a $44 million cryptocurrency theft [1]. The incident, first reported by The Times of India, involves a sophisticated social engineering attack in which Agarwal allegedly allowed malware to be installed after receiving a call from an unknown German number [2]. The breach occurred on July 19, 2025, when an unauthorized individual, believed to be using Agarwal’s credentials, initiated a small 1 USDT transaction, triggering an internal investigation. Hours later, $44 million was siphoned from the platform and distributed across six external wallets [3].

Nebilo Technologies, the company that operates CoinDCX, confirmed the unauthorized access to its internal systems through Agarwal’s compromised login credentials. During his questioning, Agarwal denied involvement in the hack but admitted to moonlighting with several external parties without proper vetting [4]. His personal bank account also received ₹15 lakh ($17,000) from an unverified source, further raising concerns about potential collusion or coercion [5].

CoinDCX CEO Sumit Gupta described the attack as a “sophisticated social engineering attack,” and stated that a First Information Report (FIR) had been filed with the Karnataka Police [6]. The company declined to provide further public details, citing the ongoing nature of the investigation [7]. This incident adds to a troubling trend of increasing cyberattacks on cryptocurrency platforms in 2025, with losses already surpassing those recorded in full years in previous years [8]. The broader industry continues to grapple with the fallout from a string of high-profile breaches, including the $1.5 billion theft from Bybit in February of this year [9].

The CoinDCX case highlights the vulnerabilities that can arise from both external cyber threats and internal mismanagement. Analysts have warned that geopolitical tensions, evolving cybercrime tactics, and insufficient internal security measures continue to leave even well-established platforms exposed [10]. This incident underscores the urgent need for crypto firms to enhance employee screening, enforce strict internal protocols, and implement robust monitoring systems [11].

Law enforcement is currently working to trace the stolen funds and determine whether Agarwal was a willing participant or a victim of manipulation. The broader crypto market remains on high alert as the case progresses [12].

---

Source:

[1] https://cryptopotato.com/coindcx-software-engineer-arrested-in-connection-to-44-million-hack-report/

[2] https://bravenewcoin.com/insights/coindcx-software-engineer-arrested-after-44-million-crypto-exchange-hack

[3] https://cointelegraph.com/news/coindcx-hack-employee-arrested-44m-crypto-theft

[4] https://99bitcoins.com/news/presales/coindcx-software-developer-arrested-in-connection-with-44m-crypto-hack-coinbase-to-buy-the-indian-exchange/

[5] https://spectrum-search.com/insights/44-million-heist-at-coindcx-exposes-social-engineering-risk-in-web3-recruitment

[6] https://www.rootdata.com/news/145005

[7] https://www.coinspeaker.com/scam-alert-here-is-real-reason-coindcx-was-hacked-for-44-million/

[8] https://tradersunion.com/news/cryptocurrency-news/show/410107-coindcx-insider-investigated/

[9] https://defi-planet.com/2025/07/coindcx-employee-arrested-following-44-million-crypto-heist-linked-to-social-engineering-attack/