CoinDCX Hack Investigation Takes a Dramatic “Inside Job” Turn

The investigation into the massive CoinDCX hack took a dramatic turn when the police arrested a CoinDCX employee in connection with the heist, which saw approximately $44 million illegally transferred from the Indian crypto exchange’s systems to external wallets.

Who is the employee and how was he involved?

The employee in question is Rahul Agarwal, a 30-year-old software engineer based in Bengaluru, a city known as India’s Silicon Valley. He was arrested by local police on July 26.

Agarwal was a full-time employee at CoinDCX and had been issued a laptop restricted to office use. Following this, investigators found that the hackers used login credentials from Agarwal’s single, company-issued laptop to access the system and drain the $44 million in digital assets.

The theft occurred in the early hours of July 19. However, the initial breach was identified when one USDT was transferred from the CoinDCX platform to an external wallet.

Within hours, unauthorized transactions moved large sums to six different crypto wallets. According to police, only Agarwal’s laptop was found to have been compromised during internal checks by Neblio Technologies, the holding firm of CoinDCX.

What’s his side of the story?

When the company’s vice president, Hardeep Singh, flagged the suspicious activity, Agarwal was called in for questioning.

He denied any involvement in the theft, but here’s where it gets interesting: he admitted to working freelance jobs for multiple private clients whose identities he claimed not to know. He also told police he had received a WhatsApp call from a German number and files that may have compromised his system.

The evidence

While Agarwal claims he was unaware of the hack, police noted two key things that raised their suspicions. First, the investigators uncovered that Agarwal had received an unexplained payment of $17,116 into his bank account from unidentified sources. Second was his unknown freelance work.

The police have now seized his devices, as the investigation continues to determine if this was the result of an external attack, insider negligence, or a direct “inside job.”