CoinDCX Loses $44.2 Million in Security Breach, No Customer Funds Affected

CoinDCX, a prominent cryptocurrency exchange in India, recently experienced a significant security breach, resulting in a loss of approximately $44.2 million. The incident, which occurred around 17 hours ago, involved an attacker who initially used just 1 ETH from Tornado Cash. The stolen funds were subsequently moved from Solana to Ethereum, highlighting the sophistication of the attack.

Users of the platform have reported several disruptions, including the removal of certain trading pairs, the cancellation of spot orders, and issues with the Web3 wallet. These disruptions have left many users with unanswered questions and concerns about the security of their assets.

Sumit Gupta, the co-founder and CEO of CoinDCX, addressed the incident in a recent post on X. He confirmed that an internal operational account, used solely for liquidity provisioning on a partner exchange, was compromised. Gupta emphasized that no customer funds were affected and that all user assets remain secure in cold wallets. The breach was attributed to a server compromise, but the issue was quickly contained.

Gupta assured users that trading and INR withdrawals continue to function normally. He also stated that the losses incurred from the hack would be fully absorbed by CoinDCX’s own treasury. The exchange is currently working with cybersecurity experts to address the issue, recover the stolen funds, and implement a bug bounty program to enhance security measures. Gupta reiterated the company's commitment to transparency and promised to keep the community informed about the progress of the investigation and recovery efforts.