Indian exchange CoinDCX has lost about $444.2 million to hackers after an apparent breach of its hot wallet. The hit, which happened more than 17 hours ago, was exposed by on-chain sleuth ZachXBT after the company kept quiet about it. The stolen asset was flagged by blockchain security firm Cyvers, which then alerted ZachXBT.
“Looks like the India centralized exchange ‘CoinDCX’ was likely drained for ~$44.2M almost 17 hours ago and has yet to disclose the incident to the community,” ZachXBT posted on Telegram. He said the hacker address got 1 ETH from Tornado Cash, and then bridged part of the stolen funds from Solana to Ethereum. The hack wasn’t traced to a tagged wallet or listed in CoinDCX’s proof of reserves. Zach said he figured out the link by checking counterparties manually.
CoinDCX confirms internal account breach
After ZachXBT’s post went viral on X, the CEO of CoinDCX, Sumit Gupta, posted a statement. “Hi everyone, At CoinDCX, we have always believed in being transparent with our community, hence I am sharing this with you directly,” he said. According to Sumit, the compromised account was an internal operational wallet, not one that holds customer funds.
He said it was used “only for liquidity provisioning on a partner exchange”. The breach was caused by a “sophisticated server attack,” but Sumit claims all customer wallets were safe and hadn’t been touched. “No customer funds have been impacted. Your assets remain completely safe and protected in our secure cold wallet infrastructure. All trading activity and INR withdrawals are fully operational.”
The team was able to isolate the breach on time and says the loss will be covered by its treasury and not the customer’s assets. They have also brought in cybersecurity teams to look into the breach and patch vulnerabilities. The team is also expected to track where the funds are moving. Gupta said they’re also working with the unnamed exchange partner where the liquidity account was being used.
They plan to launch a bug bounty program to catch other possible security gaps. He also said, “Every security incident is a learning, and we will learn from this and further strengthen our platform… this is our time to win this war against cyberthreats in the industry.” He also promised real-time updates going forward: “I understand incidents like this can be unsettling – even when customer assets are unaffected. That’s why I am sharing this incident with you with full transparency. Thank you for your continued trust. I will keep you informed on a real-time basis as we learn more.”
The post CoinDCX loses $44.2 million to hackers after exploit first appeared on Coinfea.
