CoinDCX, a cryptocurrency exchange, recently reported a breach in one of its internal operational accounts. The account was being used by the company for liquidity provisioning on partner platforms. As part of its response to the breach, the company has announced a bounty or reward of up to 25 per cent of recovered assets in exchange for credible leads. Estimates indicate that the July 19 breach resulted in a loss of approximately $44 million, or around Rs 380 crore.
CoinDCX confirmed that wallets used to hold customer assets were not affected by the attack and are still secure. The exchange also confirmed that no customer funds were lost, and trading as well as withdrawals in Indian Rupees can continue normally.
The company attributed the attack to a sophisticated server intrusion and said that it is actively collaborating with law enforcement authorities, cybersecurity specialists and blockchain partners to locate the stolen funds. The exchange seeks to recover lost funds by coordinating efforts across the ecosystem.
CoinDCX claims that it has launched the largest bounty recovery programme in India. The programme aims to incentivise ethical hackers, researchers, and ecosystem partners to assist in tracing the stolen cryptocurrency and identifying those behind the breach.
A bounty programme is an initiative where individuals or groups are incentivised with rewards for performing designated tasks, commonly related to identifying bugs, reporting vulnerabilities, or providing crucial intelligence.
This initiative is open to ethical hackers, white-hat researchers and cybersecurity experts within the Web3 ecosystem. If the entire amount lost in the breach is recovered, the bounty can be up to $11 million.
The company claims that most of the compromised assets were stored in two wallets, one holding approximately 155,830 SOL (approximately 27.6 million dollars) and the other holding around 4,443 ETH (approximately 15.7 million dollars).
CoinDCX has partnered with firms such as Sygnia, zeroShadow and Seal911 to assist in the investigation. It is also working closely with ecosystem players, including the Solana Foundation, Superteam and bridge protocol partners like Wormhole and deBridge.
The company reiterated that the breach affected only one of its internal operational accounts used solely for liquidity provisioning on partner exchanges.
