Indian Crypto Exchange Security: Where the Problem Is and Who Is Responsible

By Sam Giri · 12 November 2026

Developing story. Written on 12 November 2026 from public reports. Details will change. Not financial advice.

India may have 70 to 90 million crypto users, by one industry estimate that includes many inactive accounts. Most are young and many live outside the big metros. In the same week, a national cyber agency warned that AI-assisted attackers are targeting exchanges, and another long-running Indian exchange reported unauthorised access to its servers. This is the right moment to ask a plain question: where does the security problem actually sit, and who owns it?

What is happening this week

CERT-In warning (4 to 5 November). India's cyber agency rated its advisory critical and named a threat group, CRAFTY FALCON. It says the group uses AI tools to study targets, steals wallet keys and abuses payment APIs, and has hit firms again after they had fixed earlier issues. It also says attacks favour weekends and holidays. It did not name any affected exchange or give a loss figure.
Unocoin (9 to 12 November). Unocoin's own update confirms unauthorised access to its servers on 9 November. It disabled user logins as a precaution, says no cryptocurrency funds have been lost, and says users cannot access accounts until its investigation and fixes are complete. No newer company update had been found by 12 November. Separately, on-chain trackers report that about 81,000 linked addresses show zero balances and the website was returning errors; Unocoin has not publicly explained this, and it is not confirmed whether those movements were theft or the exchange moving funds itself. This is a confirmed security incident. The company says no funds have been lost, and that claim has not been independently verified.

What is confirmed from earlier incidents

WazirX (July 2024): about $230 to 235 million was taken from a multisig wallet, roughly 45% of its reserves. Reports have attributed the attack to North Korea's Lazarus Group. A year later, users were still waiting for refunds while the exchange went through a court process.
CoinDCX (July 2025): about $44 million left an internal operational account used for liquidity with a partner exchange. The company said customer assets were held separately and untouched.
Regulation tightened afterwards. FIU-IND now requires crypto service providers to obtain a cybersecurity audit from a CERT-In empanelled auditor for registration and renewal, alongside stricter KYC and reporting. The latest official count, from March 2026, is 54 registered service providers.

Where the problem actually is

1. Keys and internal systems, not the blockchain. Both big Indian hacks involved wallet and account infrastructure around the exchange, not the blockchain itself. Cryptography held. Access control, signing processes and operational accounts did not.

2. Hot money outside customer cold storage. Operational and liquidity accounts are often treated as lower risk. Attackers go for the weaker door.

3. One-time audits against continuous attackers. CERT-In's own warning says some firms were hit again after remediation. A passed audit is a snapshot. Weekends and holidays, when teams are thin, are when monitoring matters most.

4. Phishing and fake apps hit users directly. This part has nothing to do with exchange hacks. Indian authorities' data shows cyber-fraud complaints of about 21.8 lakh and losses of about ₹19,813 crore in 2025, and about 12.7 lakh complaints and ₹10,179 crore in the first half of 2026. These are all cyber frauds, not only crypto, but crypto is often reported as one route for moving the money. Typical crypto cases reported this year: fake trading apps showing fake profits, then a "withdrawal fee"; WhatsApp and social-media investment groups; and stolen wallet keys. Of the money lost over 2021 to May 2026, reports say about ₹10,718 crore was frozen but only about ₹323 crore was refunded. Once it leaves, it rarely comes back.

5. Trust is thin, so rumours move faster than facts. When an exchange goes quiet, users fill the silence with guesses, and scammers fill it with fake "recovery" links.

Who is responsible for what

Party	Responsibility
Exchanges	Keep customer assets segregated and in cold storage; lock down operational accounts and signing keys; monitor 24/7 including holidays; publish proof of reserves; disclose incidents quickly and plainly; decide in advance who covers losses.
Regulators (FIU-IND, CERT-In)	Enforce audits beyond the registration stage; require incident reporting with timelines; share threat intelligence early; act against unregistered and offshore apps.
Banks and payment platforms	Detect and freeze mule accounts faster; flag sudden transfers to crypto platforms; make UPI and bank-side reporting quick.
Users	Use only registered platforms; turn on app-based 2FA, not SMS only; never share seed phrases or OTPs; check app and website addresses; report fraud immediately on the 1930 helpline and cybercrime.gov.in.
Founders and community managers	Keep one official channel, warn members about fake support and recovery links, and separate confirmed facts from rumour.

No single party can fix this alone. Exchanges own custody. Regulators own the rules. Users own their own keys and clicks. The gaps between them are where the money disappears.

What would actually improve things

Treat operational wallets like customer wallets. Same controls, same monitoring.
Continuous security, not annual paperwork. Red-team tests, staffed holiday monitoring, and key-ceremony reviews.
Published incident playbooks. Within hours: what happened, what is affected, what is not, when the next update comes.
Clear loss-allocation rules. Users should know before they deposit who bears the loss in a hack. CoinDCX and WazirX handled this very differently.
User education at the point of risk. Warnings inside apps and payment flows, in local languages, especially for first-time and non-metro users.

If you hold funds on an Indian exchange this week

Do not panic-withdraw through random links. Use the official app or website only.
Expect fake "compensation" and "claim" messages. The exchange will not DM first and will never ask for your seed phrase or OTP.
Check the exchange's own channels for the investigation results before acting on social-media screenshots.
Keep long-term holdings out of any single platform where you can, and know how self-custody works before you try it.

If you run a community for an exchange or a project, review your bad-day plan now. See What 1M+ Members Taught Me, Trust Is the Product and The Binance Hack: What We Know. If you want a second pair of eyes on your incident-response plan, you can book a short call at cal.com/samgiri/intro.

Sources (public reporting, to 12 Nov 2026)

Sam Giri is a Web3 community builder and founder working across Web3, FinTech and PropTech. This article is general information based on public reports and is not financial or legal advice.