CoinDCX

Is CoinDCX safe?

CoinDCX is a reasonable choice by Indian standards, with one big caveat: Indian law does little to protect what you keep on any exchange. In July 2025 attackers took $44 million from a company account, and CoinDCX paid for it out of its own treasury. No customer lost money. It also publishes reserve statements that compare its holdings with what it owes users.

We score CoinDCX 55/100. That puts it well above WazirX, whose customers absorbed a 2024 hack, but below exchanges in countries with real custody rules, such as Upbit in Korea.

What happened in the July 2025 hack

Early on 19 July 2025 an attacker drained an internal operational account that CoinDCX used to provide liquidity on a partner exchange. Chief executive Sumit Gupta said the account was compromised in a "sophisticated server breach" and that, because operational accounts are kept apart from customer wallets, the loss was limited to that account. Co-founder Neeraj Khandelwal put the loss at $44 million and said CoinDCX's treasury would bear it.

Bengaluru police later said attackers posing as recruiters persuaded a CoinDCX engineer to install malware on his work laptop, giving them access to company systems. The engineer was arrested and denied taking part in the theft. CoinDCX offered a recovery bounty of up to 25% of any funds returned and said it was working with CERT-In and outside security firms.

The handling was good. The cause was not. A single employee laptop opening a path to $44 million points to weak internal controls, and that is why we score security history at 65 rather than in the 80s.

Does CoinDCX hold enough to cover customers?

CoinDCX began publishing proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary in December 2022, after the collapse of FTX. Unlike some exchanges, it reports liabilities as well as assets. Its statement for July to September 2023, which it describes as audited by its statutory auditor, showed reserves of 159.1 million USDT against 157.2 million USDT owed to users, a thin but positive surplus.

Two limits apply. These are snapshots on one date, and they do not show the company's other debts, as full audited accounts would. CoinDCX also held reserves on partner exchanges at the time, so part of what backs your balance depends on other platforms. We found no report newer than mid-2024 during this check.

Who regulates CoinDCX?

Neblio Technologies Pvt Ltd, the Indian company behind CoinDCX, is registered with the Financial Intelligence UnitFinancial intelligence unitA national government agency that receives reports of suspicious transactions from banks and crypto firms and analyses them for money laundering.More in the glossary (FIU-IND) as a reporting entity under India's anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary law. That means customer checks and reports of suspicious transactions. It is not a licence, and it sets no rules on capital, custody or client money.

Protection	CoinDCX (India)
Crypto licence	None exists in India
Client asset segregation	Company policy only
Deposit insuranceDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary	None for crypto or rupee balances on the exchange
Proof of reservesProof of reservesA report in which a crypto exchange shows that it holds enough coins to cover all customer balances, ideally checked by an outside firm.More in the glossary	Periodic, with liabilities, auditor-checked

The group has grown beyond India. It bought BitOasis, an exchange in the UAE, in 2024, and Coinbase Ventures invested again in October 2025 at a $2.45 billion valuation. Coinbase's stake brings a large shareholder with a reputation to protect, but it is a minority investment and gives you no claim on Coinbase.

The WazirX allegation

In a 2025 affidavit in its Singapore case, WazirX reportedly claimed CoinDCX had held user funds in a Lithuanian entity that was not registered in India until February 2025. Gupta denied it, saying Indian users' rupees and crypto have always been held by Neblio Technologies and that no user funds were moved to Lithuania. No regulator or court has made a finding, so we do not count it against the score.

How to use CoinDCX more carefully

1. Turn on an authenticator app and withdrawal address allowlisting, and treat unexpected "support" calls as phishing.
2. Keep only trading balances on the exchange; move long-term coins to a wallet you control.
3. Be careful with futures and earn products, which add leverage or lending risk on top of exchange risk.
4. Check that any app you use is CoinDCX's own; fake apps and Telegram "recovery agents" target users after every hack.

How we scored it

Legal record (70) is CoinDCX's strongest factor, with no enforcement action found. Licensing (38) is the weakest, because India offers only anti-money-launderingAnti-money launderingThe rules and checks that stop criminals from moving illegal money through banks, payment firms and crypto exchanges.More in the glossary registration. Security history (65) reflects a large hack that cost customers nothing but exposed weak internal controls.