Indian crypto exchange CoinDCX has become the latest victim of a major cyberattack, with hackers stealing $44 million in digital assets by exploiting a fake job offer. Authorities say the breach stemmed from malware installed on a company-issued laptop belonging to a CoinDCX engineer.
Social Engineering Attack Behind Massive Crypto Theft
According to Bengaluru police, the attackers posed as recruiters and tricked Rahul Agarwal, a 30-year-old software engineer, into installing malware under the pretense of a part-time job opportunity. The compromised laptop gave hackers access to CoinDCX’s internal operational wallet system, allowing them to initiate unauthorized withdrawals.
Police have arrested Agarwal and seized his laptop, though he maintains he was unaware of the scheme.
The stolen funds were linked to CoinDCX’s operator, Neblio Technologies, with investigators confirming the malware was the primary breach vector.
CoinDCX Assures User Funds Are Safe
Earlier this month, CoinDCX described the incident as a “server breach”, assuring customers that user funds remain unaffected. The company has pledged to fully cover the loss, taking steps to improve internal security practices and access protocols.
CEO Sumit Gupta confirmed the loss came from an internal wallet and would be absorbed by the exchange.
$11 Million Recovery Bounty Offered
In an effort to recover the stolen funds, CoinDCX has launched a Recovery Bounty Programme, offering 25% of the missing assets — roughly $11 million — to anyone who can assist in locating or retrieving the stolen crypto.
Authorities are also investigating the possibility of foreign actors, though no group has yet claimed responsibility. The exact destination of the funds remains undisclosed.
Second Major Crypto Breach in India in a Year
This is the second major breach targeting an Indian exchange in the last 12 months. In July 2024, WazirX lost $230 million in a hack linked to North Korea’s Lazarus Group. That case remains under investigation.
The CoinDCX incident underscores the growing threat of social engineering attacks in crypto and the importance of employee cybersecurity awareness.
Disclaimer
This content is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency trading involves risk and may result in financial loss.