Indian Crypto Exchange CoinDCX Investigates $44M Theft Linked to Employee's Compromised Credentials

An Indian cryptocurrency exchange, CoinDCX, is under investigation following a $44 million theft that occurred on July 19. A permanent software engineer, Rahul Agarwal, has been arrested by Bengaluru police in connection with the breach, after hackers reportedly exploited his login credentials to gain unauthorized access to internal systems [1]. According to local reports, the breach was traced back to Agarwal’s work laptop, which had been compromised by malware, allowing attackers to transfer funds to multiple wallets [2].

Agarwal, who had been employed at CoinDCX for over two years, was reportedly engaged in part-time freelance work while still employed at the firm. During questioning, he denied involvement in the theft but admitted to the secondary employment [3]. CoinDCX has not publicly confirmed the arrest, but its CEO, Sumit Gupta, posted on X stating the company is conducting an internal investigation and cannot engage with the media during this period [4]. Gupta described the breach as a “sophisticated social engineering attack,” emphasizing that such incidents often target employees [5].

The breach is believed to have occurred during a night shift when an unknown individual gained access to the system and transferred one Tether USDT stablecoin before initiating the larger theft. The stolen assets were reportedly moved to six different wallets, suggesting a premeditated and coordinated effort [6]. Authorities have stated that Agarwal was issued a company laptop strictly for work purposes, which raises questions about the adequacy of internal safeguards and monitoring [7].

CoinDCX has maintained that no user funds were compromised, as the breach targeted an internal account used for liquidity provisions with another exchange. The firm has urged the public and media to avoid spreading unverified information, which could hinder the ongoing investigation [8]. The incident has sparked broader industry discussions on the need for stricter access controls, stronger authentication protocols, and continuous monitoring of employee activities [9].

As a result, the case has drawn attention to the vulnerabilities within the cryptocurrency sector and the growing sophistication of cybercriminal tactics. Unlike traditional external breaches, this incident involved the exploitation of trusted access, highlighting the risks posed by insider threats [10]. The outcome of the investigation may influence future regulatory requirements in India, particularly concerning mandatory reporting and enhanced compliance measures for crypto firms [11].

The broader market has shown little immediate reaction, with major cryptocurrencies like Bitcoin and Ethereum maintaining their trends. However, the incident may contribute to increased regulatory scrutiny and affect investor confidence in the long term. As the case unfolds, the response from CoinDCX and other exchanges in terms of policy and security improvements will be critical in restoring trust within the sector [12].

---

Source:

[1] Cointelegraph - [https://cointelegraph.com/news/coindcx-hack-employee-arrested-44m-crypto-theft](https://cointelegraph.com/news/coindcx-hack-employee-arrested-44m-crypto-theft)

[2] The - [https://www.cryptotimes.io/2025/07/31/coindcx-employee-arrested-in-44-million-crypto-hack-case/](https://www.cryptotimes.io/2025/07/31/coindcx-employee-arrested-in-44-million-crypto-hack-case/)

[3] Coinpedia - [https://coinpedia.org/crypto-live-news/](https://coinpedia.org/crypto-live-news/)

[4] The - [https://www.cryptotimes.io/](https://www.cryptotimes.io/)

[5] CoinDCX employee arrested in $44M crypto theft - [https://coinpedia.org/](https://coinpedia.org/)

[6] ioc.one - [https://ioc.one/](https://ioc.one/)

[7] Crypto News - [https://cryptonews.com/news/](https://cryptonews.com/news/)