Investigation into $44 million Crypto Hack Leads To Employee's Laptop
A software engineer at CoinDCX has been arrested by the Indian authorities after investigations of the company's recent hack found that the heist was conducted using his login credentials.
Bengaluru City police believe the exchange's software engineer in question, Rahul Agarwal, wasn't the person who conducted the crime.
Instead, the hackers compromised his work laptop and got hold of Agarwal's credentials, which ultimately allowed them unauthorized access to the company's servers.
During the questioning, Agarwal also denied involvement in the crypto theft, but revealed that he has been secretly taking on part-time work for four private clients, which was a blatant violation of his work contract.
There is also a possibility that one of these four clients could be the mastermind behind the crypto heist.
CoinDCX Defends Its Employees
CoinDCX had also stepped forward to defend its employees, urging the media and public to avoid speculation or the circulation of unverified information while the investigation is still ongoing.
When asked for further details regarding the case, the exchange was adamant to keeping mum, citing the CEO Sumit Gupta's X post that stated that the exchange cannot engage with media amid ongoing investigation.
In his X post, CEO Gupta also called the hack a social engineering attack, adding that employees are often targeted in such attacks.
Who is Rahul Agarwal?
According to his LinkedIn profile, prior to his arrest, Agarwal has been working for CoinDCX for over two years, building his career in DevOps domain.
Agarwal joined CoinDCX as a senior software engineer in May 2023. After two years, he was promoted to staff engineer in April 2025, a role he currently holds and performs on-site.
According to Indian Express, local authorities has revealed that Agarwal was tricked by the hackers to download the malware on his office laptop.
This new development in the case comes a week after the CoinDCX CEO Gupta reported that the exchange had suffered a hack on July 19.
But he assured fans that no user funds were affected by the exploit, adding that the hackers had managed to infiltrate into the company's internal account used for "liquidity provision" through a server breach.