The $44 million hack of Indian crypto change CoinDCX has been traced to a compromised laptop computer belonging to a software program engineer on the firm, who has been arrested in Bangalore.
The Instances of India reviews that Rahul Agarwal had used his laptop computer, which had been offered “strictly for office work” to hold out aspect gigs for “three to four private parties without being aware of their credentials.”
Agarwal suspects that recordsdata despatched to him as a part of this work “could have been a bait,” permitting the hacker to compromise his login credentials which have been later used within the heist.
An inside investigation discovered that Rs 15 lakh (roughly $17,000) had been paid to Agarwal “from an unknown source.”
In line with police, he’d been in touch with a German quantity concerning the work.
The hack befell on July 19, and was flagged by on-line sleuth ZachXBT who identified that the theft had taken place “almost 17 hours ago and [CoinDCX] has yet to disclose the incident to the community.”
Lower than two hours later, the corporate formally acknowledged the hack, additionally encouraging “maxis” to work together with the publish on X to thank advertising supervisor Suchit Karande for his “transparency.”
Responses to Agarwal’s arrest have ranged from incredulity on the “negligence” of an engineer at a crypto change opening “random” recordsdata on a piece laptop computer, to suspicions as as to if he’s “a victim or culprit” trying to camouflage a task within the heist as carelessness.
CoinDCX assault a traditional instance of ‘developer-phishing’
Blockchain safety agency Halborn printed an explainer on the hack, which it referred to as “a classic example of an exchange hack likely involving a compromised private key.”
The report underlines “the importance of implementing strong security controls for backend infrastructure” which safety audits typically don’t cowl.
As such, these assault vectors are more and more focused by would-be hackers.
大家注意下这个投毒风险，某黑客组织在 V2EX 伪装招聘发帖，福利比较诱惑，面试者会被诱导基于这个黑客组织提前准备好的带毒仓库作为项目模板开发一个页面，面试者如果下载并调试执行，电脑就会中毒并可能导致加密货币及一些账号权限被盗等损失。
细节直接见帖子及评论区：https://t.co/lSZgMCTZTB https://t.co/oLx0QC4kAL
— Cos(余弦)😶🌫️ (@evilcos) July 28, 2025
In a Chinese language-language publish, he warned of the specter of hackers conducting “fake job recruitment on V2EX,” a Chinese language tech and developer group platform.
The sting entails candidates utilizing “a pre-prepared, malicious repository provided… as the project template” which, if run, will infect their system and will steal “cryptocurrency and account credentials.”
