Investigators traced the intrusion back to July 19, 2025, when hackers extracted a single USDT token from CoinDCX\u2019s corporate reserves. Within hours, they escalated their access and drained roughly $44 million into six external wallets. CoinDCX\u2019s security team flagged the anomaly later that morning and immediately seized the suspect\u2019s company laptop, which forensic analysis revealed as the attack\u2019s entry point.<\/p>\n\n\n\n
\u2022 July 19, 2025: First USDT transfer detected
\u2022 Several hours later: $44 million siphoned into six wallets
\u2022 Security alert: rapid response and device seizure
\u2022 Forensics: only one device showed signs of compromise<\/p>\n\n\n\n
Police arrested Rahul Agarwal on July 26 in Whitefield, Bengaluru, following a complaint and an internal probe by Neblio Technologies, CoinDCX\u2019s parent firm. Agarwal joined CoinDCX as a senior engineer in May 2023 and earned a promotion to staff engineer in April 2025. During questioning, he denied orchestrating the theft but confessed to working freelance projects on the side. He also admitted receiving an unexplained deposit of \u20b915 lakh into his personal account.<\/p>\n\n\n\n
Investigators uncovered chat logs showing a WhatsApp call from a German number. During that call, Agarwal was instructed to install and run files\u2014later identified as malware\u2014on his work laptop. Authorities now coordinate with international cybercrime units to trace the German connection and follow blockchain trails obscured by crypto mixers.<\/p>\n\n\n\n
This incident highlights how social-engineering tactics can penetrate corporate systems when organizations lack strict segmentation and robust endpoint security. CoinDCX has pledged to reimburse affected users and is reviewing its security protocols. Experts stress the importance of insider-threat monitoring, regular security audits, and employee training on phishing and suspicious attachments.<\/p>\n\n\n\n
Meanwhile, law enforcement continues to map fund flows and identify possible accomplices. Until those hackers\u2019 wallets are traced, much of the stolen $44 million remains hidden.<\/p>\n","protected":false},"excerpt":{"rendered":"
The breach unfolds Investigators traced the intrusion back to July 19, 2025, when hackers extracted a single USDT token from CoinDCX\u2019s corporate reserves. Within hours, they escalated their access and drained roughly $44 million into six external wallets. CoinDCX\u2019s security team flagged the anomaly later that morning and immediately seized the suspect\u2019s company laptop, which […]<\/p>\n","protected":false},"author":10,"featured_media":9869,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[30,2,43],"tags":[],"class_list":{"0":"post-14933","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-exchange","8":"category-featured","9":"category-general-news"},"acf":[],"yoast_head":"\n