Cybersecurity Firm Traces CoinDCX's Hack to North Korean Lazarus Group

New evidence has emerged, with evidence pointing towards the North Korean hacking group, Lazarus Group, as the culprit behind the most recent CoinDCX exchange.

This is the second Indian exchange the North Korean group has targeted, raising massive alarm bells in India.

Cybersercurity firm Cyvers claims that the CoinDCX hack follows the same exploit pattern as another top Indian exchange, WazirX.

The cybersecurity team also noted that WazirX's security breach interestingly also occurred on the exact date just one year ago, which resulted in a loss of $234 million through a series of suspicious transactions.

Experts warn the repetition is no coincidence but may signal deliberate, targeted attacks on the region’s largest crypto platforms.

It noted that the North Korean hackers carefully planned a pre-attack setup from July 16, conducting a test transactions on 1 USDT.

Analysis shows the Lazarus Group meticulously set the stage days in advance.

On July 16, hackers executed a “test transaction” with just 1 USDT—laying the groundwork for the main event.

When the real strike came, it took just five minutes for the attackers to drain $44 million in USDT and USDC from one of CoinDCX’s operational wallets on the Solana network.

Seven rapid-fire transactions moved the funds across chains, showcasing a level of speed and technical precision that stunned security teams.

Was it a Coincidence? Experts Think Not

According to Cyvers, the synchronized breaches at both WazirX and CoinDCX should be seen as a “warning” rather than random bad luck.

“If Lazarus is accelerating its focus on India’s largest exchanges, preemptive threat prevention isn’t optional—it’s the only line of defense,”

The incident highlights an urgent need for heightened security across the Indian crypto sector.

In the aftermath, CoinDCX moved quickly to reassure customers: user funds, according to the exchange, have not been impacted by the hack, which targeted just their operational wallet.

To track down the lost assets, CoinDCX has launched a recovery bounty program—offering up to 25% of any retrieved funds to white-hat individuals or teams who help recover the stolen crypto.

If fully redeemed, the bounty could reach as much as $11 million.

CEO Sumit Gupta addressed the community on X (formerly Twitter), underlining the importance of identifying and apprehending those responsible

“Such things shouldn’t happen again, not with us, not with anyone in the industry… We will fight this and ensure the Indian crypto community comes out of this stronger.”