$44M CoinDCX Hack Linked to North Korea’s Lazarus Group Same Day as WazirX Breach
Mumbai, July 22, 2025— Indian crypto exchange CoinDCX has confirmed a $44 million hack, now traced to the notorious North Korean Lazarus Group, the same cybercrime syndicate behind numerous global cryptocurrency heists. What’s even more alarming — the attack occurred on the same date and used the same method as the 2024 WazirX breach, prompting speculation of a coordinated campaign against Indian crypto infrastructure.
Sophisticated Breach, Familiar Playbook
CoinDCX’s internal team, in collaboration with international cybersecurity firms and blockchain forensic analysts, identified that the exploit mimicked wallet manipulation and API vulnerabilities previously seen in the WazirX attack.
“The signatures, tactics, and transaction routing mirror the Lazarus Group’s modus operandi — particularly in how the stolen assets were laundered through mixers and privacy-centric blockchains,” said a cybersecurity analyst working on the case.
Despite the large sum stolen, CoinDCX has assured all users that their funds remain safe, stating that the losses were absorbed by the company’s reserves and insurance coverage.
$11M Bounty Offered
In a bold move, CoinDCX has placed an $11 million bounty for any credible information leading to the identification or apprehension of those involved. This mirrors a growing industry trend of turning to the public and white-hat hackers for assistance in combating cybercrime.
Lazarus Group’s Digital Warfront
The Lazarus Group, widely believed to be backed by the North Korean government, has made headlines over the past decade for brazen attacks on crypto platforms, including Axie Infinity’s $620M hack, KuCoin, and now CoinDCX. Intelligence agencies suggest these operations help fund Pyongyang’s sanctioned weapons programs.
A Pattern of Indian Exchange Attacks
The recurrence of hacks targeting Indian crypto exchanges—two of the nation’s largest—in a one-year span, on the exact same date, raises questions about surveillance gaps and vulnerability in domestic platforms. Experts are calling for greater coordination between private exchanges and national cyber defense teams.
“Whether it’s a coincidence or a signal, July 20 may now go down as a ‘Red Flag Day’ in Indian crypto history,” remarked blockchain researcher Rohan Mehta.
What’s Next for CoinDCX?
CoinDCX has temporarily suspended API trading and wallet withdrawals for a security overhaul. The exchange has also initiated a third-party audit, expected to conclude within two weeks. CEO Sumit Gupta emphasized the company’s commitment to transparency and user protection:
“This is a tough moment, but we’ve faced challenges before. Our users come first — and we will come out of this stronger, smarter, and more secure.”
Industry on High Alert
This latest breach is a wake-up call for the crypto industry across Asia. With state-sponsored groups like Lazarus evolving their tactics, exchanges, DeFi platforms, and custodians must invest more in real-time threat monitoring, zero-trust architecture, and cross-border intelligence sharing.
Disclaimer and Risk Warning
coinweck does not endorse or is responsible for any content, accuracy, quality, advertising, products, or other materials on this page. The image used in this article is for informational purposes only and is provided to us by a third party. coinweck should not be held responsible for image copyright issues. Contact us if you have any issues or concerns. Readers should do their research before taking any actions related to the company.