Inside the CoinDCX Breach:

On July 19, 2025, CoinDCX—one of India’s largest cryptocurrency exchanges—confirmed a major security breach resulting in the loss of approximately $44 million (Rs. 378 Crore). While no customer funds were affected, the scale and sophistication of the attack raise critical questions about infrastructure-level security in the digital asset space.

In this blog, we’ll break down what really happened, why it matters, and how the right security measures—like Privileged Access Management (PAM) and Multi-Factor Authentication (MFA)—can make all the difference.

What Happened?

According to a public statement by CoinDCX Co-founder and CEO Sumit Gupta, the breach targeted one of the company’s internal operational accounts used solely for liquidity provisioning on a partner exchange. This account was part of CoinDCX’s backend infrastructure and not directly linked to customer-facing wallets.

While the attack did not impact customer funds, the attackers made off with a significant sum by compromising internal systems and accessing liquidity reserves.

The Attack Unfolded in Phases

1. Server Compromise:

The breach originated from a sophisticated intrusion into CoinDCX’s liquidity infrastructure. While exact technical details remain undisclosed, initial findings point toward unauthorized access through compromised credentials or weak endpoint controls.

2. Unauthorized Access to Partner Account:

Once inside, the attackers gained control of an operational account on a partner exchange. This account had access to large volumes of digital assets used for market making and liquidity operations.

3. Fund Laundering Strategy:

The stolen assets were moved in carefully calculated batches of 1,000 to 4,000 SOL. The attackers used the Solana-Ethereum Wormhole bridge and swap aggregator Jupiter to route the funds across wallets and blockchains.

– One wallet now holds 4,443 ETH, valued at $15.7 million.

– Another still holds 155,830 SOL, valued at $27.6 million.

4. Incident Response and Investigation:

CoinDCX immediately engaged two global cybersecurity firms and notified the Indian Computer Emergency Response Team (CERT-In). A forensic investigation is underway to trace the attack path and identify vulnerabilities.

How CoinDCX Handled It

Unlike other crypto breaches—such as the WazirX incident in 2024 where users were locked out of their funds—CoinDCX was quick to reassure its user base. The company confirmed that all customer wallets were safe and unaffected, and that it would absorb the entire financial loss.

The CEO also addressed investors directly on social media, encouraging them not to panic sell. His message emphasized long-term confidence and urged users to let the market stabilize before making emotionally driven decisions.

CoinDCX also announced plans to launch a bug bounty program to encourage ethical hackers to report vulnerabilities before they can be exploited.

Could This Breach Have Been Prevented?

Yes—likely.

Most high-profile breaches today don’t result from a single point of failure. Instead, they stem from a chain of missed controls: compromised credentials, misconfigured access rights, and a lack of real-time monitoring. These are precisely the weaknesses that modern security tools like PAM and MFA are designed to address.

How PAM and MFA Could Have Made a Difference:

Privileged Access Management (PAM)

– Enforces strict control over who can access sensitive systems.

– Enables “just-in-time” access, eliminating the need for standing privileges.

– Records and audits all privileged session activity.

– Reduces the risk of lateral movement by isolating infrastructure segments.

Multi-Factor Authentication (MFA)

– Adds an extra layer of verification even if passwords are stolen.

– Requires OTPs, biometrics, or hardware tokens for access.

– Adapts based on risk signals like device type, location, or login time.

– Prevents unauthorized logins from suspicious environments.

When combined, PAM and MFA support a Zero Trust model—one that assumes no user or device should be trusted by default. Every access attempt is verified in context, making it significantly harder for attackers to move laterally or escalate privileges.

The Broader Implication

The CoinDCX breach should serve as a wake-up call to all digital asset platforms and fintech providers. Strong perimeter security is not enough. Attackers are increasingly targeting internal systems, APIs, and operational accounts—places where traditional defenses fall short.

By investing in modern identity and access controls like PAM and adaptive MFA, organizations can dramatically reduce the risk of internal compromise, protect critical assets, and maintain customer trust even in the face of rising threats.

Final Thoughts

CoinDCX’s transparent response and willingness to cover the loss set a strong precedent for accountability in the crypto industry. But the real lesson lies in prevention.
Securing infrastructure today means going beyond firewalls and antivirus. It means controlling who gets access, when, and under what conditions—before a breach ever happens.

Want to learn how PAM and MFA can secure your infrastructure? Contact Us Today to explore how modern identity and access security can help your organization stay ahead of today’s threats.