HomeStartups & AchieversStartup Deep DiveStartup Deep Dive : CoinDCX — how a 4 million hack and...

Startup Deep Dive : CoinDCX — how a 4 million hack and a tax shock didn’t sink India’s costliest crypto exchange

On 19 July 2025, hackers drained $44 million from an internal operational wallet at CoinDCX, India’s most valued crypto exchange — and the company kept running the next morning, absorbing the entire loss from its own reserves rather than touching a single customer’s coins. Eight months later, in March 2026, the exchange’s two founders were arrested by Mumbai police over a fraud complaint that, CoinDCX says, was never about them at all: a case built around a lookalike website the company had already reported to authorities more than a thousand times.

Both episodes are true, both are strange, and both say something real about what it takes to survive as a regulated crypto business in India. CoinDCX has been through a banking ban that nearly killed it before launch, a tax change that erased most of its trading volume overnight, a nine-figure security breach, and now a reputational crisis it did not create. It is also, on paper, one of the few Indian crypto exchanges that is actually profitable. How both things can be true — survival and fragility at once — runs through its funding history, its tax-exposed business model, and the numbers below.

Quick facts

Company CoinDCX, operated in India by Neblio Technologies Private Limited, under Mauritius-incorporated parent DCX Global Ltd
Founded 2018, Mumbai
Founder(s) Sumit Gupta (CEO) and Neeraj Khandelwal, both IIT Bombay alumni
Businesses Spot, futures, margin and P2P crypto trading; staking; the Okto self-custody Web3 wallet; UAE/MENA exchange BitOasis
Latest FY revenue ₹559.6 crore (~$58.3 million) operating revenue, FY25 (year ended March 2025), per regulatory filings
Latest FY profit/loss ₹1.7 crore net profit, FY25, per Inc42’s review of filings
Listed Private; no IPO announced
Market value / last valuation $2.45 billion post-money, per Coinbase’s October 2025 investment, cleared by the Competition Commission of India in December 2025
Key shareholders or CEO CEO Sumit Gupta; investors include Coinbase Ventures, Pantera Capital, B Capital Group, Polychain Capital, Steadview Capital and Bain Capital Ventures

What they do

CoinDCX is a cryptocurrency exchange and Web3 platform built for Indian retail users, with a newer international arm. On the core app, a user can buy and sell bitcoin, ether and other tokens against rupees, trade crypto futures with leverage, use a peer-to-peer desk to move rupees in and out without a bank rail touching the exchange directly, and stake select tokens for yield. Alongside the exchange sits Okto, CoinDCX’s self-custody Web3 wallet, which the company says has crossed 20 million users globally and is aimed at people who want to hold and use crypto without leaving funds on an exchange. In July 2024, CoinDCX acquired Dubai-based BitOasis, giving it a second retail and institutional exchange business across the UAE and wider Middle East and North Africa region — its first step outside India. The common thread is a bet that most people do not want to manage private keys, gas fees or offshore exchange accounts themselves; they want an app that looks like any other fintech product and happens to trade crypto.

The origin

Sumit Gupta and Neeraj Khandelwal met as students at IIT Bombay. Gupta went on to work at L&T Infotech and Sony before starting ListUp, an app for buying and selling used electronics; Khandelwal worked at the hospitality startup Holachef and at DoorMint. In 2018 the two pooled their savings and set up CoinDCX from a flat in Mumbai, betting that Indian retail investors wanted a simple, rupee-denominated way into crypto rather than the offshore, dollar-only exchanges most were using at the time. The insight was less about crypto itself than about access: India had tens of millions of smartphone users who had never held a foreign brokerage account and needed an on-ramp that spoke their language, accepted UPI and bank transfers, and did not require them to trust an exchange registered somewhere they had never heard of.

That plan met its first obstacle before the company had even properly opened for business. Days ahead of launch, the Reserve Bank of India issued a circular, on 6 April 2018, barring RBI-regulated banks from servicing anyone dealing in virtual currencies. Gupta later said the notice arrived just three days before CoinDCX was due to go live, forcing the founders to rebuild the product overnight around a peer-to-peer model that did not need a bank to touch crypto transactions directly.

The struggle years

The banking ban was not a one-off inconvenience; it defined CoinDCX’s first two years. With banks unwilling to service crypto firms, the company operated on the P2P workaround while joining, as the only petitioner still active in the case, a Supreme Court challenge brought by the Internet and Mobile Association of India against the RBI’s circular. On 4 March 2020, the Supreme Court struck down the RBI’s April 2018 order as disproportionate and unconstitutional, restoring crypto exchanges’ access to banking. It took roughly two years of operating in a regulatory grey zone, on a workaround, before CoinDCX had normal banking rails at all.

The next crisis was financial rather than regulatory. After India’s 2022 crypto tax regime hit trading volumes hard (detailed below), CoinDCX’s revenues and margins never fully recovered to pre-tax levels, and by August 2023 the company laid off 71 of its roughly 590 employees, about 12% of its workforce, in its second such round that year. The company cited “tough macro conditions,” a prolonged crypto bear market and the impact of the new tax rules on trading volumes and revenue as the reasons.

Then came the July 2025 breach. On 19 July 2025, attackers compromised an internal operational account CoinDCX used for liquidity operations with a partner exchange, reportedly by first compromising the work laptop and credentials of a CoinDCX engineer, and moved out roughly $44 million. CEO Sumit Gupta called it a “sophisticated server breach,” said the affected account was isolated quickly, and confirmed customer funds — held separately in cold storage — were unaffected; CoinDCX absorbed the entire loss from its own treasury. Notably, the attack landed almost exactly a year after rival exchange WazirX suffered a much larger, $235 million breach in July 2024, underlining that custody risk is a live, recurring problem across the sector rather than a one-off failure specific to any single platform.

Most recently, in March 2026, Thane police arrested Gupta and Khandelwal on a cheating complaint from an insurance advisor who alleged he was promised high returns and a CoinDCX franchise, worth about ₹71.6 lakh, between August 2025 and February 2026. CoinDCX has publicly rejected the case, saying it is the work of fraudsters impersonating the founders and the company, pointing to more than 1,212 fake websites impersonating coindcx.com that it says it reported to authorities between April 2024 and January 2026. The FIR names the founders directly, and it remains before the courts; whatever its outcome, the episode shows how a brand built on user trust can be attacked through impersonation as easily as through a server breach.

The turning point

If one event reshaped CoinDCX’s business more than any funding round, it was India’s 2022 crypto tax overhaul. The Union Budget introduced a flat 30% tax on crypto gains effective 1 April 2022, and a 1% tax deducted at source (TDS) on crypto transactions effective 1 July 2022. The effect was immediate and brutal: trading volumes across Indian exchanges, CoinDCX included, fell by close to 70% within days of the TDS taking effect, and by roughly 90.9% on CoinDCX specifically by 3 July 2022, just two days after the rule kicked in. Gupta has since said publicly that the tax pushed an estimated 95% of Indian trading volume to offshore platforms that are far harder for local regulators to monitor, and that CoinDCX’s revenues settled at roughly a third of pre-tax levels. The same before-and-after gap shows up a year later in the balance sheet: the 12% layoffs of August 2023 were a direct, delayed consequence of a single policy change made 16 months earlier, not of any product failure or competitive loss.

The money behind it

CoinDCX has raised more than $247 million across seven-plus rounds through 2022, before the undisclosed sum Coinbase added in 2025. It became India’s first crypto unicorn in August 2021, raising a $90 million Series C at a $1.1 billion valuation led by B Capital Group — the firm co-founded by Facebook’s Eduardo Saverin — alongside Coinbase Ventures, Polychain Capital, Block.one and Jump Capital; Gupta framed the raise around scaling from roughly 4 million to 50 million users. Less than a year later, in April 2022, CoinDCX raised a $135 million Series D led by Pantera Capital and Steadview Capital Management, reported at a $2.15 billion valuation by TechCrunch and The Block and at $2.2 billion by Bloomberg — the small gap likely reflects different disclosure timing, but both accounts agree it made CoinDCX the highest-valued crypto company in India at the time. New investors Kingsway, DraperDragon, Republic and Kindred joined existing backers B Capital, Coinbase, Polychain and Cadenza in that round.

The most recent capital came from Coinbase itself. In October 2025, Coinbase increased its investment in CoinDCX’s Mauritius parent, DCX Global Ltd, in a deal valuing the company at $2.45 billion post-money; the Competition Commission of India cleared the non-controlling minority stake on 16 December 2025, formally closing the transaction. Of its backers, three stand out for what they specifically changed: B Capital’s 2021 cheque brought the credibility and Western venture network that made CoinDCX’s unicorn round possible; Pantera Capital’s 2022 lead deepened its bench of crypto-native, cycle-tested investors just before the market turned down; and Coinbase Ventures, a backer since 2020 across multiple rounds, converted from a financial investor into a strategic one with the 2025 deal, tying CoinDCX’s UAE and India ambitions to Coinbase’s own international expansion.

How it makes money

CoinDCX earns most of its revenue the way any exchange does: a cut of every trade. Spot trading uses a tiered maker-taker model with fees commonly cited in the 0.1%-0.3% range depending on a user’s 30-day volume; futures trading charges a standard maker fee of 0.025% and taker fee of 0.075%; and the P2P desk charges 0.2% to both sides of a transaction. On top of trading fees, CoinDCX earns interest income from margin trading, where it lends users funds to trade larger positions, and it charges withdrawal fees on certain assets, while typically not charging for deposits. Users who pay fees with or hold CoinDCX’s own token get a 10-25% discount, which nudges volume toward the platform’s own ecosystem. In its regulatory filings, this whole bundle shows up simply as “revenue from operations” or “sale of services.” The part people commonly get wrong is assuming CoinDCX’s fortunes track crypto prices — a bull run means people trade more, a crash means they trade less, but both still generate fee revenue. What actually moves CoinDCX’s revenue far more violently, as the 2022 tax shock showed, is government policy: a single tax rule change did more damage to its top line in one week than any crypto bear market has.

The numbers

CoinDCX’s Indian entity, Neblio Technologies, swung from a loss to sustained (if thin) profit over the past four fiscal years, even as revenue has been volatile in both directions.

Year Revenue (₹ crore) Net profit / (loss) (₹ crore)
FY22 588 (41)
FY23 447.24 28.25
FY24 391.76 15.46
FY25 559.6 (operating revenue) 1.7

FY22 and FY23 figures come from YourStory’s review of Neblio Technologies’ regulatory filings, published January 2024; FY24 figures from a separate YourStory review published September 2024; FY25 figures from Inc42’s review published October 2025. There is a notable discrepancy worth flagging: Inc42’s FY25 article describes FY25 net profit as “up about 15%” from an approximately ₹1.5 crore FY24 base, which does not match the ₹15.46 crore FY24 figure reported by YourStory from the same underlying filings. The two accounts have not been reconciled publicly, so both are noted here. What is consistent across sources is the broader pattern: revenue collapsed after the 2022 tax change (down from ₹588 crore in FY22 to ₹391.76 crore in FY24), then rebounded sharply in FY25, up 43% year-on-year, alongside a 48% jump in total expenses to ₹550.2 crore — driven by an eightfold jump in advertising spend, to ₹51 crore, and a 41% rise in IT costs, to ₹101.1 crore — which is why the profit line has stayed thin even as the top line recovered.

Where the money comes from

CoinDCX does not publish a formal revenue split by product or geography in the way a listed company would. What is disclosed points to heavy concentration in Indian retail spot and futures trading, with margin trading, staking (the company has advertised yields up to 20% APY on select assets) and P2P as smaller, newer contributors. The 2024 BitOasis acquisition gives CoinDCX its only meaningful non-India revenue base, serving retail and institutional crypto users across the UAE and wider MENA region, though the company has not broken out what share of group revenue BitOasis contributes. Company disclosures around the October 2025 Coinbase round put annualised, group-wide transaction volume at about $165 billion and annualised revenue near ₹1,179 crore (~$141 million) as of mid-2025 — a materially larger, forward-looking figure than the ₹559.6 crore FY25 operating revenue reported in Neblio Technologies’ India filings for the year to March 2025, because it appears to include international operations, later months, and a run-rate rather than an audited full-year number. The surprise, for an exchange whose business is nominally about crypto prices, is how much more its results move with Indian tax policy than with bitcoin’s chart: the 2022 TDS rule, not any crypto crash, is the single event most responsible for its multi-year revenue decline.

The risks

The clearest and most persistent risk is tax policy CoinDCX does not control. The 1% TDS and 30% flat tax introduced in 2022 remain in force as of September 2026, and Gupta has said publicly that the regime still pushes the large majority of Indian trading volume to offshore platforms outside the reach of local tax and compliance rules — a structural disadvantage for any exchange, like CoinDCX, that stays fully compliant onshore.

The second is custody and operational security. The July 2025 breach happened not through a smart-contract exploit or a market manipulation, but through compromised employee credentials on a work laptop, giving attackers a path into an internal liquidity wallet holding $44 million of company funds. That the same failure mode — an exchange’s own operational systems, not user wallets — had already cost WazirX $235 million a year earlier suggests the risk is systemic to how Indian exchanges manage internal keys and liquidity partnerships, not isolated to one company’s engineering practices.

The third is reputational and increasingly hard to fully control: brand impersonation. CoinDCX says it reported over 1,212 fake websites and apps impersonating it between April 2024 and January 2026, and the March 2026 fraud case against its founders, whatever its legal outcome, shows how impersonation-driven fraud can escalate into arrests and headlines that a company itself did not create and cannot simply switch off.

The takeaway

CoinDCX’s history is a reminder that for a regulated financial platform, the biggest threats rarely come from a competitor’s better product. They come from a regulator’s circular, a tax rule change, a compromised employee laptop, or a fraudster with a lookalike domain — each one capable of doing more damage in a week than years of market competition. The company’s response to each has been the same: absorb the loss, keep the core service running, and let the underlying business — millions of retail users who still need a simple, rupee-denominated way to hold crypto — carry it through. That is a survivable strategy, as CoinDCX’s own numbers show, but it is not a comfortable one, and nothing in its ten-year run so far suggests the external shocks are going to stop arriving.

Frequently asked questions

Who founded CoinDCX and when?

CoinDCX was founded in 2018 in Mumbai by Sumit Gupta and Neeraj Khandelwal, both IIT Bombay alumni. Gupta previously worked at L&T Infotech and Sony and ran a used-electronics startup, ListUp; Khandelwal had worked at Holachef and DoorMint. Gupta remains CEO.

What is CoinDCX’s current valuation?

CoinDCX was last valued at $2.45 billion post-money, based on Coinbase’s increased investment announced in October 2025 and cleared by India’s Competition Commission in December 2025. That is up from a reported $2.15-2.2 billion in April 2022 and $1.1 billion when it became India’s first crypto unicorn in August 2021.

What happened in the CoinDCX hack?

On 19 July 2025, attackers compromised an internal operational wallet used for liquidity operations with a partner exchange, reportedly via a compromised employee’s work laptop, and stole about $44 million in company funds. Customer assets, held separately, were unaffected, and CoinDCX absorbed the loss from its own reserves.

Is CoinDCX profitable?

Yes, on a small scale. Its India entity, Neblio Technologies, reported net profit of ₹1.7 crore in FY25 on operating revenue of ₹559.6 crore, following ₹15.46 crore profit in FY24 and ₹28.25 crore in FY23 (though one report puts the FY24 base lower, at about ₹1.5 crore, a discrepancy that remains unreconciled). FY22 was a loss year, at ₹41 crore.

Why were CoinDCX’s founders arrested in March 2026?

Thane police arrested Sumit Gupta and Neeraj Khandelwal over a cheating complaint alleging a ₹71.6 lakh fraud involving promised high returns and a fake CoinDCX franchise. CoinDCX has rejected the allegations, saying they stem from fraudsters impersonating the founders and the company through fake websites, and that the accounts named in the complaint are unrelated to CoinDCX. The case remains before the courts.

Sources

Figures are as of September 2026. Currency converted at $1 ≈ ₹96.0 as of 18 September 2026 (Trading Economics).

  • Scroll.in, “How two long-time college friends built India’s first crypto unicorn”, 2021
  • The Block, “Saverin-backed exchange becomes India’s first crypto unicorn”, August 2021
  • Officechai, “CoinDCX becomes India’s first crypto startup unicorn, raises funds at $1.1 billion valuation”, August 2021
  • Bloomberg, “Pantera leads CoinDCX funding round at $2.2 billion valuation”, April 2022
  • TechCrunch, “Indian crypto exchange CoinDCX tops $2.1 billion valuation in new $135 million funding”, April 2022
  • The Block, “Indian crypto exchange CoinDCX raises $135 million, now valued at $2.15 billion”, April 2022
  • Business Standard, “Cryptocurrency exchange CoinDCX cuts staff by 12% as revenues hit by slump”, August 2023
  • Inc42, “Crypto unicorn CoinDCX fires 12% workforce in second round of layoffs”, August 2023
  • YourStory, “Crypto unicorn CoinDCX turns profitable, earns Rs 28 Cr in FY23 as it curbs expenses”, January 2024
  • TechCrunch, “CoinDCX acquires BitOasis in international expansion push”, July 2024
  • YourStory, “CoinDCX profit drops 45% in FY24”, September 2024
  • CoinDesk, “Indian crypto exchange CoinDCX suffers $44M hack”, 19 July 2025
  • TechCrunch, “Indian crypto exchange CoinDCX confirms $44 million stolen during hack”, 21 July 2025
  • Business Standard, “CoinDCX to absorb $44 million security breach loss: CEO Sumit Gupta”, August 2025
  • Deccan Herald, “Crypto-exchange CoinDCX hit by $44.2 million security breach; founders say customer funds unaffected”, July 2025
  • Halborn, “Explained: The CoinDCX Hack (July 2025)”, 2025
  • TechCrunch, “Coinbase boosts investment in India’s CoinDCX, valuing exchange at $2.45B”, 14 October 2025
  • Blockhead, “Coinbase invests in India’s CoinDCX at $2.45B valuation”, 15 October 2025
  • Inc42, “CoinDCX’s FY25 profits jump 15% to INR 1.7 Cr”, October 2025
  • Medianama, “CCI clears Coinbase’s minority stake in CoinDCX’s parent”, December 2025
  • BusinessToday, “CoinDCX founders arrested amid fraud probe; firm says scammers posing as them misled the public”, 22 March 2026
  • Business Standard, “CoinDCX founders arrest: Mumbai FIR, crypto scam, fake website, impersonation”, March 2026
  • MediaNama, “CoinDCX co-founders arrested in Rs 71.6 lakh crypto fraud case”, March 2026
  • Indiankanoon.org, “Internet and Mobile Association of India vs Reserve Bank of India”, 4 March 2020 (Supreme Court judgment)
  • TraderUnion, “All CoinDCX fees: is it cheap or expensive? (September 2026)”
  • StartupTalky, “CoinDCX business model: how does CoinDCX make money”
  • Tracxn, “CoinDCX company profile, team, funding, competitors and financials”, 2026

Found an error? Write to us and we’ll correct it in the open, dated, on the piece.

The Invincible India
The Invincible Indiahttps://www.theinvincibleindia.in
The Invincible India is a digital magazine celebrating the spirit of India — covering national news, culture and heritage, travel, festivals, startups and inspiring people, with a special focus on Udaipur and Rajasthan. Our team brings readers stories that showcase an incredible and invincible India.
RELATED ARTICLES

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Stay Connected

46,000FansLike
11,500FollowersFollow
2,280SubscribersSubscribe

Most Popular