The two largest hacks of Indian crypto exchanges in recent years are WazirX in July 2024 and CoinDCX in July 2025. At WazirX, a multi-signature wallet was breached and more than $230 million was lost, about 45% of user funds; trading and withdrawals were halted and users were repaid under a court-approved scheme in Singapore. At CoinDCX, about $44 million was lost from an internal operational account; the company said customer funds were not affected and it absorbed the loss, and Bengaluru police later said attackers posing as recruiters got an engineer to install malware.
The lessons for users are practical. Understand that coins on any exchange depend on that exchange's security. Learn how self-custody works. Know how to withdraw before you need to. Keep your records. And recognise that the attackers in these cases went after the exchange's systems and people, which tells you exactly what you need to protect on your side too.
Why I am writing this, and how
I co-founded Unocoin in 2013, so I have spent thirteen years running a Bitcoin platform in India. That makes me careful about this topic. When an Indian exchange gets hacked, it is not a win for anyone else. People lose savings. Trust in the whole space drops. New users stay away. Everybody in the industry pays.
So this is a factual timeline, built from the public record, with no comparisons and no claims that it could never happen somewhere else. Every platform, including the one I co-founded, is run by people and systems that can fail. The point is to learn what users can control.
WazirX, July 2024
What happened. In July 2024, a multi-signature wallet at WazirX was breached. Losses were more than $230 million, about 45% of user funds. Trading and withdrawals were halted.
What followed. The company went through a restructuring in the Singapore High Court. The court rejected the first scheme in June 2025. An amended scheme received 95.7% support from voting creditors in August 2025 and was approved on 15 October 2025. Under it, 85.5% of portfolio value was to be paid within 10 business days of the scheme becoming effective, with the remaining 14.5% through recovery tokens. Operations were to move to Zanmai India.
A legal side effect. On 25 October 2025, in a case brought by a WazirX user over 3,532 XRP, the Madras High Court held in an interim order that crypto is property capable of being possessed and held in trust, though not currency.
What it teaches. Multi-signature wallets are a strong security design, but a design is only as strong as the processes and systems around it. And when a platform freezes, users with coins on it wait. Users with coins in their own wallets do not.
CoinDCX, July 2025
What happened. In July 2025, about $44 million was lost from an internal operational account at CoinDCX. The company said customer funds were not affected and that it absorbed the loss.
How it happened. Bengaluru police later said the attackers posed as recruiters and got an engineer to install malware. In other words, the entry point was a person, not a flaw in the blockchain.
What it teaches. Social engineering works on professionals, not only on beginners. A fake job offer, a fake test file, a convincing conversation. If attackers can use that method on an exchange engineer, they can use it on you.
What attackers targeted
Look at both cases and you see a pattern. Neither was an attack on Bitcoin's network itself. The attacks went after:
- Hot or operational wallets and the systems that control them. Funds that need to move often are exposed to more risk.
- The approval process. Multi-signature setups depend on every signer seeing and approving the right thing.
- People. A convincing recruiter was enough to get malware onto a machine inside a company.
This is why exchanges talk about cold storage, which means keeping most assets offline, away from systems an attacker can reach over the internet. For example, Unocoin states that 95% of assets are held in cold storage with multi-signature wallets and regular security audits. That is Unocoin's own statement, and there is no independent public attestation of it on this site. Read every platform's security claims the same way: a stated policy, not a guarantee.
What users can control
You cannot audit an exchange's wallets. But you control more than you think.
Your own accounts
- Turn on two-factor authentication for your exchange and your email.
- Use a unique password for your exchange account.
- Never share your OTP, password, PAN or seed phrase with anyone who contacts you. Real support never asks.
- Do not install files or apps sent by strangers, including "recruiters" and "support agents". That is exactly how the CoinDCX attackers got in.
Your choice of platform
- Check that the platform's legal entity is on FIU-IND's published list of registered VDA service providers. Registration is about anti-money-laundering rules, not a guarantee against hacks, but it is a baseline.
- Read what the platform says about where it holds assets.
- Check how long it has operated, and how it behaved in hard times.
Your exit
- Know how to withdraw to your own wallet. Do a small test withdrawal before trusting any platform with more.
- Keep statements and transaction records. In a restructuring, your claim depends on what you can show you held.
Self-custody basics
The lesson I repeat most, after thirteen years, is this: learn self-custody, and use a platform that lets you withdraw.
Self-custody means holding Bitcoin in a wallet where you control the keys. No exchange hack or freeze can touch it. In exchange, you take on the responsibility the exchange used to carry. Your seed phrase is the master key. Write it down on paper, keep it offline in a safe place, never photograph it, never type it into a website, never share it with anyone for any reason.
You do not have to move everything at once. Start small. Send a little to your own wallet, check it arrived, practise restoring a wallet from the seed phrase with a tiny amount, and build confidence.
On Unocoin, Asset Controls let you move assets to your own wallet with zero-fee transfers, and batch BTC withdrawals are free. Whatever platform you use, find the equivalent and learn it before you need it.
The common view among practitioners is that sending coins to a wallet you own is not a sale, though that is a view, not a ruling. Either way, keep records of every transfer for your Schedule VDA. The self-custody and tax guide explains what to keep.
The honest bottom line
Crypto in India is unregulated as an asset, and there may be no regulatory recourse for losses. Hacks happen. The users who come through them best are the ones who understood the risk beforehand: they kept records, they knew how to withdraw, and they did not leave more on a platform than they needed to.
And if a hack ever affects a platform you use, slow down before you act. Read only the platform's official announcements, keep your records, and ignore anyone who contacts you offering to recover funds for a fee. If you lose money to a scam, call 1930 or file at cybercrime.gov.in as fast as you can.
Run the platform safety checklist on whatever exchange you use today, including ours.
Common questions
Which Indian crypto exchanges were hacked?
The largest recent cases are WazirX, where a multi-signature wallet was breached in July 2024, and CoinDCX, where an internal operational account was compromised in July 2025.
How much was lost in the WazirX hack?
More than $230 million, about 45% of user funds. A Singapore High Court-approved scheme from 15 October 2025 set 85.5% of portfolio value to be paid first and 14.5% through recovery tokens.
How did the CoinDCX hack happen?
About $44 million was lost from an internal operational account in July 2025. Bengaluru police later said attackers posing as recruiters got an engineer to install malware. The company said customer funds were not affected.
Is my crypto safe on an Indian exchange?
Coins on any exchange depend on that exchange's security, and crypto is unregulated as an asset in India. Use a registered platform, turn on two-factor authentication, never share OTPs or seed phrases, learn self-custody and test withdrawals.