Indian crypto exchange CoinDCX hacked, $44M drained

Indian cryptocurrency exchange CoinDCX was hacked on Friday leaving the exchange drained of $44 million. 

The hackers compromised one of CoinDCX’s internal accounts used for “liquidity provisions” with another exchange through a server breach.

No user funds were affected by the exploit, according to CoinDCX CEO Sumit Gupta. The CEO also said that all customer funds remain safe and wrote:

“The incident was quickly contained by isolating the affected operational account. Since our operational accounts are segregated from customer wallets, the exposure is only limited to this specific account and is being fully absorbed by us, from our own treasury reserves.”

“The attacker’s address was funded with 1 Ether ETHUSD from Tornado Cash and later bridged a portion of the stolen funds from Solana to Ethereum,” onchain sleuth ZachXBT said.

Cointelegraph reached out to CoinDCX for comment but was unable to obtain a response by the time of publication.

Analyst Infinity Hedge noted that popular Indian exchange WazirX was hacked for $235 million on this exact date, one year ago — a reminder of the persistent cybersecurity threats facing the crypto industry and investors.

Other exchanges compromised by hackers last month

Iranian exchange Nobitex was hacked for $100 million on June 18 in a politically-motivated attack by a pro-Israel hacker group calling itself “Gonjeshke Darande.”

After stealing $100 million in the initial hack, the group leaked the source code for the exchange online, further exposing users of the crypto platform.

GMX V1, a version of the GMX Protocol perpetual exchange operating on the Arbitrum blockchain network, suffered a cybersecurity exploit on July 9, with the hacker making away with $40 million.

However, the hacker returned the stolen funds several days later, accepting a $5 million white hat bounty in return for the $40 million in crypto.

Decentralized finance (DeFi) platform Arcadia Finance was the target of a smart contract exploit on Tuesday, leading to $3.5 million in crypto drained by the threat actor.