Excerpts from the Open House with CoinDCX Leadership team.
To our valued CoinDCX community and customers,
First and foremost, we want to extend our heartfelt gratitude to our customers, partners, and the crypto community for the incredible support and trust you’ve shown over the last few days. It has been a challenging period, and your unwavering confidence has been a tremendous source of strength for our team as we’ve worked around the clock.
For us at CoinDCX, our customers’ trust is everything. While we have received numerous media requests, we believe our primary responsibility is to you, our community. You deserve to know the full picture, with facts and data, straight from our team. This post is our single source of truth, designed to cut through the noise and address any misinformation circulating online.
Security incidents are unfortunate. What truly defines a platform is not whether it faces a challenge, but how it responds. Our response is guided by one principle: protecting our customers, always.
The Most Important Things First: What You Need to Know
Before we dive into the details, here are the key facts:
- Your Funds Are 100% Safe: All customer assets are, and have always been, secure in segregated, cold wallets that were not affected by this incident.
- Contained Incident: The breach was limited to one of our internal operational hot wallets used for liquidity management. No customer wallets were compromised.
- CoinDCX Covers the Entire Exposure: CoinDCX is covering the exposure entirely from its own treasury reserves. The financial impact of this incident is on us.
- Platform Is Fully Operational: Trading, INR Deposits, and INR Withdrawals are fully functional and have been running throughout this period.
- Investigation and Recovery: We are working closely with global cybersecurity experts, forensic agencies, and law enforcement authorities to investigate the incident and track the funds.
- Beware of Misinformation: Please rely only on our official channels – our app, website, and verified social media handles – for all communications.
Your Questions, Answered Directly
During the live session on 21st July 2025 at 7 PM, our entire leadership addressed your questions directly. Here’s a summary of the key points discussed.
Q: What exactly happened, and what immediate actions did you take?
Neeraj Khandelwal, Co-Founder:
The incident involved unauthorized access to one of our operational hot wallets on a partner exchange. These wallets are used by our internal systems to ensure smooth liquidity for trades and are separate from customer funds.
As Neeraj explained in our live session, “The moment our systems detected the anomaly, our first move was to contain and isolate. This ensured that the incident was limited and did not spread to any other part of our infrastructure, especially our cold wallets where customer funds are held.” Our team immediately secured all systems, verified the integrity of our cold storage, and began a thorough internal investigation.
Q: How can you ensure this will not happen again in the future?
Neeraj Khandelwal explains this incident, while unfortunate, is a powerful learning experience. We are not just fixing the issue; we are re-architecting parts of our system to be even more resilient. We are working with top global cybersecurity firms to audit our infrastructure and are already implementing their recommendations.
As Neeraj stated, “Our goal is to evolve our infrastructure so that even operational funds have minimal exposure, moving closer to a zero-risk environment.” We are also working to move more of our operational funds to secure cold wallets.
Q: Why was there a 17-hour delay in the official announcement?
Sumit Gupta, Co-Founder:
Our first priority is always to act, not just to speak. Before making a public statement, we had to ensure the threat was fully contained, our platform was secure, and all customer funds were safe. Communicating with incomplete or unverified information would have been irresponsible and could have caused unnecessary panic.
Sumit addressed this directly: “We chose to be thorough first, then transparent. Once we had a clear picture and had taken all necessary steps to secure the platform, we communicated the facts to our community.”
Q: What is the current situation with INR withdrawals? Why were there delays?
Mridul Gupta, Founding Partner:
INR withdrawals have been, and continue to be, fully operational. Some users experienced delays over the weekend, which was a result of operational challenges caused by high withdrawal volumes during non-banking hours. It was not a freeze on funds.
As Mridul clarified, “All INR withdrawal requests, regardless of the amount, will be processed by tonight. We appreciate your patience, and we are working to ensure the experience is seamless.”
Update: As on 21st July 2025 at 9:03 P.M., as confirmed by Sumit Gupta, on his official X profile, 100% of the withdrawal requests have been successfully processed.
Q: How will this incident affect the financial strength of CoinDCX?
Rohit Jain, Head of DeFi Initiatives & Okto:
CoinDCX is a financially strong, healthy, and profitable business. Our corporate treasury ($100M+ reserves) is more than sufficient to absorb this loss without impacting our operations, growth plans, or our ability to serve our customers.
As Rohit shared, “Our India exchange business is profitable, and we continue to invest in building for the long term. Our investors have also reached out to offer their full support, though we don’t need it. We are in a very healthy financial position.”
Update: As on 22nd July 2025 at 3 PM – Read more about it here.
Q: Is there a chance of recovering the stolen funds?
Neeraj Khandelwal:
Yes, there is always a chance. We are working tirelessly with global agencies, law enforcement, and on-chain forensic firms to track and recover the funds like Solana Foundation, Wormhole, Zero Shadow & deBridge. However, our ability to operate and protect our customers is not dependent on this recovery.
Neeraj explained, “To that end, we’ve launched a Recovery Bounty Program, committing 25% of any recovered funds to those who help us. This is a fight against bad actors for the entire industry, and we invite the community to help us.”
Q: Why did the prices of tokens like USDT, XRP, and Bitcoin drop on CoinDCX? When will this be resolved?
Mridul Gupta:
This was a direct result of market dynamics. When FUD and misinformation spread, some customers began to panic-sell. This created a temporary imbalance between buyers and sellers on our exchange, causing prices to dip. This was not a technical error.
As Mridul explained, “As customers saw that INR withdrawals were working and their funds were safe, confidence returned, and prices have already recovered significantly. They will continue to normalize as trading activity returns to usual levels.”
Q: Why are multiple tokens under maintenance? Why was the Web3 Mode disabled?
Mridul Gupta:
These are two separate, coincidental events.
- Spot Markets Maintenance: The downtime for 15 spot markets was a pre-planned maintenance activity that began before the incident. We were upgrading our liquidity partners for these tokens. Two markets are already live, three more will be live tonight (21st July) , and the rest will be restored soon.
- Web3 Mode: We temporarily limited some functions on our self-custodial Web3 Mode as a precautionary measure. These limitations will be lifted within this week.
Q: Today it was an operational wallet. What if a cold wallet is compromised in the future?
Neeraj:
This is a critical question. Cold wallets, by definition, are kept completely offline and are not connected to any online servers that can be hacked remotely. Accessing them requires multi-party, multi-location physical and digital approvals. This multi-layered security makes a remote compromise of our cold wallets virtually impossible. The security architecture is designed specifically to prevent such an event.
Q: What is the status of Crypto Withdrawals? Why aren’t they available to all users?
Mridul:
We understand that enabling crypto withdrawals for all users is a feature our community has been eagerly awaiting. We want to assure you that we hear you, and our teams are actively working on this.
As Mridul explained in our live session, the Indian ecosystem presents unique challenges. “Unfortunately, in India, crypto withdrawals can be very risky. There are many instances where bad actors dupe users into sending them crypto, which is then withdrawn from the platform. To protect our users from such fraudulent activities, we have adopted a very cautious, risk-first approach.”
Our primary responsibility is to create the safest possible environment for our users. Because of the risks involved, we are rolling out this feature in a phased and controlled manner.
- Current Status: We have already enabled crypto withdrawals for over 10,000 of our users as part of this phased rollout.
- Our Plan: We are continuously working on strengthening our risk models and compliance frameworks. Our goal is to expand access to more users while ensuring the highest level of security.
We are committed to making this feature widely available, and we will continue to roll it out to more users as our systems become even more robust.
A Final Word from Our Team
Our journey has always been about building a safe, secure, and trusted crypto ecosystem in India. We are here for the long run, and this incident has only strengthened our resolve and commitment to our mission.
We will continue to be transparent and keep you updated on our progress. Once again, thank you for your trust and support. Please rely only on our official channels for information.
This incident has only strengthened our resolve. Now, it’s back to what we do best.
Building the future of crypto in India, together.
ICYMI, watch the full stream here.
