CoinDCX heist traced to fake job scam

Table of Contents

An employee of CoinDCX’s parent business, Neblio Technologies, has been arrested by Bengaluru police in connection with the CoinDCX heist on 19th July, 2025. The reported theft was of $44 million of cryptocurrency that caused a massive cybersecurity problem rocking India’s crypto economy. When spyware infiltrated Rahul Agarwal’s company-issued laptop, it is alleged that he was the point of entry for hackers. Using this access, the hackers took millions out of the company’s internal cryptocurrency wallets.

How the CoinDCX heist was planned

Reportedly, the breach resulted from a social engineering attack, where hackers pretended to be international recruiters offering freelance work. According Bitcoin.com, Agarwal was contacted via WhatsApp by individuals using foreign numbers, including from Germany. Believing it to be a legitimate job opportunity, he downloaded files secretly embedded with malware. Once installed, the software gave hackers unauthorised access to CoinDCX’s wallet infrastructure. Before executing the central heist, the attackers first conducted a small test transfer involving Tether (USDT). Over a few hours, they moved $44 million worth of crypto assets into six external wallets. This incident is particularly troubling as it didn’t require deep hacking of CoinDCX’s servers—just a compromised employee device. As CryptoSlate and AInvest noted, it’s a textbook case of attackers bypassing technical defences by targeting human vulnerability. Suspicions of insider participation were raised when investigators found over $17,000 in unusual deposits in Agarwal’s bank account. While working at CoinDCX, Agarwal acknowledged “moonlighting” on freelancing work but vehemently denied knowing about the theft. H is assisting investigators and says he was tricked into installing the spyware. Nonetheless, authorities seized his electronic devices and are continuing forensic analysis. As reported by Coingape and CoinEdition, the investigation is still trying to determine whether he was merely negligent or actively complicit. The attackers made initial unauthorised transactions early in the day. By evening, they had siphoned the full amount. In a statement from CoinDCX’s CEO, the breach was described as a “sophisticated social engineering attack.” The company reassured users that no customer funds were lost—only internal company assets were affected.

CoinDCX heist’s aftermath: The company’s efforts

To aid recovery efforts, CoinDCX launched an $11 million bounty program for information leading to the return of the stolen funds. However, the funds were quickly dispersed across multiple wallets, making traceability a complex challenge. NameCoinNews and Ground. News reported that blockchain forensic experts are tracking the stolen crypto, but no funds have been recovered. This breach again highlighted the alarming rise in fake job scams targeting tech and crypto employees. It is a poignant reminder that no technical security can compensate for a lack of human vigilance. As Coinspe ker and Cybersecurity News emphasised, social engineering remains one of the most effective—and dangerous—ways to exploit digital systems.

Indian police jump into the fray

The Bengaluru Police are working closely with CoinDCX’s internal security teams to uncover whether other individuals may have been involved. Reports fr m the Traders Union and Deccan Herald suggest that additional arrests may follow, depending on the outcome of the ongoing probe. Ultimately, the CoinDCX heist scam illustrates just how vulnerable crypto platforms can be—not because of faulty code, but because of clever manipulation of the humans who operate the systems. As Indian exchanges grow and handle billions in assets, the need for strong employee training, internal controls, and real-time device monitoring has never been more apparent. Also Read PayPal’s “Pay with Crypto” ushers in new era in fintech