CoinDCX Suffers $44 Million Hack Detected by Cyvers

A significant security breach has been uncovered at CoinDCX, one of India’s leading centralized cryptocurrency exchanges.

The hack, detected approximately 20 hours ago by blockchain security firm Cyvers.AI, saw an attacker siphon off approximately $44.2 million in USDC/USDT from one of the exchange’s operational wallets on the Solana blockchain.

The incident, further detailed by Cyvers, highlights ongoing vulnerabilities in centralized exchange (CEX) platforms.

What We Know So Far

• Stolen Funds: The hacker stole around $44.2 million in USDC/USDT from a CoinDCX operational wallet on Solana.

• Attack Origin: The hack was funded with 1 ETH sourced from Tornado Cash, a notorious cryptocurrency mixer used to obscure transaction trails.

• Fund Movement: Part of the stolen funds, approximately $15.8 million, has been bridged from Solana to Ethereum, indicating a sophisticated cross-chain laundering attempt.

Current Wallet Status:

CoinDCX Wallet on Solana: Ge8dzF234QHZKFh7TYyZqdipn3BoHyZfoyz9fxEqdTRi

Hacker Address on Solana (holding $27.7M): 6peRRbTz28xofaJPJzEkxnpcpR5xhYsQcmJHQFdP22n

Hacker Address on Ethereum (holding $15.8M): 0xEF0c5b9E0E9643937D75C229648158584A8CD8D2

Total Stolen: $44 million USD

Investigation Insights

The breach was initially identified by Cyvers Alerts (@CyversAlerts), with further details provided by blockchain investigator ZachXBT.

An investigative thread from Cyvers CTO Meir Dolev (@Meir_Dv) outlines the attack’s timeline, revealing a meticulously planned operation that drained $44M in under five minutes across multiple chains

Notably, the compromised CoinDCX hot wallet was not publicly tagged or included in current proof-of-reserve reports, requiring manual attribution through counterparty analysis.

Expert Commentary

Cyvers CEO Deddy Lavid issued a stark warning following the incident:

“This hack is part of a recent wave of exchange breaches - including Bybit, WazirX, and others - are stark reminders that centralized platforms remain prime targets for sophisticated access control attacks. In Q2 2024 alone, over 65% of losses in Web3 originated from CEX-related incidents, with nearly $500 million lost due to wallet access breaches. These are not isolated events - they’re systemic weaknesses".

"We urge exchanges to rethink their security posture and move beyond reactive defenses. Real-time wallet monitoring and preemptive solutions like Cyvers’ Threat Interceptor are no longer optional - they're essential to ensure your platform doesn't become the next headline.”

This breach adds to a troubling trend of security incidents targeting centralized exchanges, with CoinDCX joining the likes of WazirX and Bybit in recent memory.

The use of Tornado Cash suggests the attacker aimed to obfuscate the funds’ origins, a tactic increasingly seen in high-profile crypto heists.

CoinDCX has yet to officially disclose the incident to the community, raising questions about transparency and response protocols.

On-Chain Media will continue to monitor this developing story, providing updates as more information becomes available. Stay tuned for real-time insights into the investigation and the exchange’s response.

Source: Original Alert by Cyvers Alerts