CoinDCX, Trust, and the Turning Point for India’s Cryptocurrency Future

By Chetna Gill

In India’s expanding digital economy, cryptocurrencies have become a testing ground for both financial innovation and regulatory uncertainty. Young professionals in Bengaluru, traders in Mumbai, and small investors across the country have poured billions into exchanges that promise autonomy and speed. Yet the last two years have shown that the system’s confidence often rests on fragile assumptions. A market transacting in trillions of rupees still operates without a coherent legal framework, leaving users dependent on corporate assurances rather than enforceable safeguards. Two exchanges—WazirX and CoinDCX—have come to symbolize the industry’s extremes: one brought down by a devastating hack, the other positioning itself as its steadier successor. But recent events suggest that stability in India’s crypto world remains more a matter of perception than of proof.
The WazirX hack of July 18, 2024, remains the most consequential breach in the country’s short crypto history. Attackers drained approximately $234.9 million from a multi-signature Ethereum wallet designed to require multiple authorizations, including those from custody provider Liminal. Investigators later linked the theft to North Korea’s Lazarus Group, which had exploited a flaw in the contract governing wallet permissions. Within hours, trading was frozen and deposits halted. WazirX’s 16 million users—95 percent of them in India—suddenly found their holdings inaccessible. Many learned through social media that funds had vanished, a communication lapse that would later compound public anger.
What followed was procedural confusion and legal gridlock. In August, parent company Zettai Pte Ltd. in Singapore invoked a four-month moratorium to block lawsuits. That move effectively transferred the fallout of an Indian crisis to foreign courts, leaving millions of Indian investors without representation. WazirX canceled trades conducted after the breach and capped cash withdrawals at two-thirds of pre-hack balances. Around 4.2 million victims were caught in limbo. CoinSwitch sued the firm for nearly $10 million in frozen funds, and a group of investors petitioned the Delhi High Court for criminal investigation. By April 2025, when the Supreme Court dismissed a plea against WazirX’s founders, citing the lack of crypto legislation, it had become clear that India’s judiciary could offer little recourse. “Cryptocurrency regulation is a policy matter best addressed by the government, not the judiciary,” the bench observed—an admission of regulatory paralysis.
The consequences rippled through the sector. Trading volumes plummeted, and user withdrawals surged across competing exchanges. Regulatory agencies such as FIU-India and CERT-In opened investigations but produced no immediate protections. WazirX filed reports with cybercrime authorities and hired Mandiant to assist with blockchain forensics, yet recovery was partial at best. The company later proposed a creditor vote in Singapore, forecasting repayments that could take years. Forensic analysts blamed lax operational discipline, including the use of online “hot” wallets for large asset reserves, as a key vulnerability—a basic error that undercut claims of institutional-grade security.
CoinDCX, a direct competitor, appeared at first to benefit from WazirX’s implosion. By late 2024, the exchange counted roughly 14 million users and had cultivated an image of compliance, emphasizing FIU-India registration and the use of segregated cold wallets. Co-founder Sumit Gupta publicly criticized WazirX’s idea of “socialized losses,” calling it “utter nonsense” and vowing that CoinDCX would never distribute the cost of a breach to customers. The remarks, widely reported, served both as a critique and as subtle marketing. In the months that followed, CoinDCX absorbed an influx of users seeking perceived safety, though the company offered little detail about how it verified the security of its own systems. Gupta later conceded that the WazirX episode had created an “image problem” for the entire sector—a statement that also acknowledged how dependent trust had become on optics.
In 2024, CoinDCX launched a ₹50-crore Crypto Investors Protection Fund, pledging two percent of brokerage income annually to bolster it. The fund was promoted as a protective cushion for users, but its mechanics were left largely undisclosed. How compensation would be triggered, who would decide eligibility, and whether payouts were insured or discretionary were questions left unanswered in the company’s statements. CoinDCX also spent considerable effort distancing itself from compliance allegations raised by WazirX in 2025, which claimed the firm had transferred funds to a non-compliant overseas entity. Gupta countered that all Indian user assets were held by Neblio Technologies, a domestic FIU-registered company. The dispute highlighted how little independent oversight exists to verify such claims beyond corporate assertion.
Then came July 19, 2025—almost exactly one year after the WazirX breach—when CoinDCX disclosed a hack of its own. Attackers exploited a vulnerability in an internal operational account and siphoned off $44 million linked to liquidity pools on a partner exchange. The company maintained that customer wallets were unaffected and that losses were absorbed by its treasury. But skepticism mounted when blockchain investigator ZachXBT revealed the breach 17 hours before CoinDCX’s official statement. For a firm that prided itself on transparency, the delay reignited debates about how exchanges communicate during crises. Temporary service disruptions, withdrawal slowdowns, and price fluctuations added to the perception that CoinDCX’s response, while financially contained, was strategically cautious in its disclosure.
CoinDCX later attributed the event to a server-side intrusion and expanded its investor protection fund by $6 million. It also launched a bug-bounty program and reiterated that “all customer assets are secure in segregated cold wallets.” While these assurances were broadly accepted, some security analysts questioned the reliability of self-issued postmortems in the absence of third-party audits. Users on social media reported intermittent access issues and delayed withdrawals, which the company described as precautionary compliance checks. The combination of self-regulation and selective disclosure illustrated the paradox of India’s crypto sector: exchanges function as both financial intermediaries and their own watchdogs.
The proximity of the two hacks—WazirX in 2024 and CoinDCX in 2025—underscored that systemic weaknesses persisted across the industry. Despite the 30 percent tax on crypto gains and 1 percent TDS on trades imposed since 2022, regulatory oversight of exchange security remained minimal. By mid-2025, trading volumes began recovering as Bitcoin and Ethereum surged globally, but confidence lagged. India accounted for a significant share of the year’s $2.17 billion in global crypto thefts. Competitors including CoinSwitch and ZebPay seized the moment to attract users disillusioned by both exchanges’ lapses. CoinDCX reported more than ₹13 lakh crore in annualized transactions, but volume alone revealed little about whether structural reforms had taken hold.
Regulators began tightening their focus. The Enforcement Directorate and CBI expanded probes into cross-border fund flows. The Bombay High Court’s 2025 ruling in favor of CoinSwitch, which required WazirX to safeguard client funds, set an early precedent for exchange accountability. CoinDCX responded with monthly “transparency reports” covering audit summaries and compliance metrics, though the underlying data was not independently verified. The firm also announced the launch of a “Transparency Centre,” a digital dashboard offering real-time metrics selected by the company itself. Cooperation with law enforcement on custody for seized assets gave CoinDCX an appearance of alignment with official agencies, but critics saw these efforts as pre-emptive brand management in anticipation of stricter oversight.
Meanwhile, CoinDCX’s growth strategy accelerated. The company secured an October 2025 investment from Coinbase valuing it at $2.45 billion and expanded into institutional custody through Bharat Custody, backed by ₹50 crore in research funding. Gupta described the deal as an opportunity to “build a compliant and regulatory-friendly crypto ecosystem,” language that mirrored earlier statements from international exchanges seeking legitimacy through compliance narratives. With reported assets under custody exceeding ₹10,000 crore, CoinDCX appeared to consolidate its position. But the optics of a foreign-backed, self-reporting exchange operating in a legal gray zone renewed concerns about how concentrated power could become in an under-regulated market.
For users, these corporate developments have offered limited reassurance. The 2025 breach, while financially absorbed, revealed the same structural opacity that plagued WazirX—a dependence on trust rather than verifiable transparency. Investor forums continue to report withdrawal delays and inconsistent communication. Security experts have pointed out that even CoinDCX’s reliance on third-party custody partners introduces potential single points of failure. The absence of mandatory audits means users must accept company statements at face value, a dynamic that contrasts sharply with expectations in traditional financial markets.
Regulatory progress remains halting. The global frameworks India advocated during its 2023 G20 presidency have yet to materialize domestically, leaving agencies like FIU-India and SEBI to improvise enforcement through registration drives and compliance advisories. Court decisions, such as the Bombay High Court’s ruling against “socialized losses,” provide piecemeal clarity but no overarching statute. In practice, accountability still hinges on public backlash rather than institutional enforcement. Exchanges market themselves as compliant while operating under minimal direct supervision.
India’s cryptocurrency market now finds itself caught between momentum and mistrust. The WazirX hack exposed how quickly user assets can vanish when governance falters. CoinDCX’s own breach, though smaller, revealed the limits of voluntary disclosure and self-policing. Both cases demonstrate that the sector’s most persistent risk is not technological—it is structural. As exchanges grow faster than the rules meant to contain them, credibility has become a product of narrative control rather than verifiable resilience. Unless regulators impose enforceable standards and independent audits, the next breach may once again test not just one company’s defenses but the credibility of India’s digital financial experiment itself.

IndraStra Global is now available on
Apple News, Google News, Feedly, Flipboard, and  WhatsApp Channel

DISCLAIMER: The views expressed in this insight piece are those of the author and do not necessarily reflect the official policy or position of IndraStra Global.

COPYRIGHT: This article is published under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. https://creativecommons.org/licenses/by-nc-nd/4.0/

REPUBLISH: Republish our articles online or in print for free if you follow these guidelines. https://www.indrastra.com/p/republish-us.html