The co-founders of CoinDCX, one of India's largest crypto exchanges, were questioned by Mumbai police on March 21, 2026, after a First Information Report was filed alleging a fraud scheme worth Rs 71 lakh (approximately $85,000). CoinDCX has denied all involvement, calling the FIR "false and filed as a conspiracy against CoinDCX by impersonators."
The case centers on a fake website, coindcx.pro, that cloned the exchange's branding and used the identities of its founders to lure victims into a fraudulent investment scheme.
A 42-Year-Old Insurance Consultant Lost Rs 71 Lakh to a Clone Site
The complainant, a 42-year-old insurance consultant based in Mumbai, told police he was approached with what appeared to be a CoinDCX-linked investment opportunity sometime between August 2025 and March 2026. He transferred a total of Rs 71.6 lakh (roughly $85,000) through what he believed was the exchange's platform.
The transfers went to third-party accounts unrelated to CoinDCX. According to Inc42, the victim did not contact the actual company before filing the FIR with police in the Mumbra jurisdiction.
The FIR names CoinDCX co-founders Sumit Gupta (CEO) and Neeraj Khandelwal (CTO), who were called to the police station for questioning on March 21. It is important to note: they were questioned, not arrested, despite some early reports using the word "arrested." Wu Blockchain's initial post on X described the situation as an arrest, but Indian outlets including Inc42, CryptoTimes, and Inshorts consistently report it as questioning in connection with the FIR.
1,212 Fake Websites in Under Two Years
CoinDCX's response points to a much larger problem. The company says it identified more than 1,212 websites impersonating its platform between April 2024 and January 5, 2026. That is roughly 1.8 fake CoinDCX sites appearing per day for 22 months straight.
The fraudulent domain in this case, coindcx.pro, is one of many that cloned the exchange's branding, UI, and even its founders' names and photos to build credibility with potential victims. CoinDCX says it published public notices warning users about these impersonation schemes and has been cooperating with law enforcement.
"The FIR filed against our co-founders is false and filed as a conspiracy against CoinDCX by impersonators," the company stated. "Impersonators posed as founders to cheat the public."
Brand spoofing is not unique to CoinDCX. Binance, Coinbase, and dozens of other exchanges have dealt with thousands of phishing domains over the years. What makes this case stand out is that police filed an FIR naming the real founders rather than the impersonators, putting the exchange in a position where it must prove it was the victim, not the perpetrator.
CoinDCX Was Already Dealing With a $44 Million Hack
This is not CoinDCX's first brush with security problems. In July 2025, the exchange lost $44.2 million in a sophisticated social engineering attack. Hackers posing as recruiters lured a CoinDCX software engineer into installing malware on his company laptop, which gave them access to an internal account used for liquidity provisioning on a partner exchange.
CoinDCX said customer funds were not affected in that incident and that it would absorb the loss. The exchange launched India's largest crypto recovery bounty, offering up to 25% of any recovered funds as a reward.
The July 2025 hack and the current impersonation fraud case are unrelated incidents, but together they illustrate the range of threats facing Indian crypto platforms: from state-sponsored hacking groups to low-cost domain spoofing operations that cost a few dollars to set up.
What This Means for Exchange Users in India
India's crypto market operates under a 30% flat tax on gains and a 1% TDS on transactions above Rs 10,000. Despite these headwinds, exchanges like CoinDCX, WazirX, and Mudrex continue to serve millions of users. The impersonation problem is particularly acute in India because crypto literacy is still developing and regulatory clarity around consumer protection remains thin.
For users, the defense is straightforward but often ignored:
- Verify the URL. CoinDCX's real domain is coindcx.com. Any variation (coindcx.pro, coindcx.net, coindcx-app.com) is fake.
- Never trust unsolicited investment pitches. Legitimate exchanges do not reach out to individuals with "high-return" offers.
- Check official channels first. If something claims to be from an exchange, verify it through the exchange's app or official social media before sending money.
The Rs 71 lakh lost in this case is a rounding error compared to the $44 million hack. But for the 42-year-old consultant who lost his savings, the distinction is irrelevant. The investigation is ongoing, and CoinDCX says it is cooperating with authorities.
The Bigger Picture: Crypto Brand Spoofing at Scale
The 1,212 fake websites CoinDCX identified is likely a fraction of the real number. Domain registration is cheap, and spinning up a convincing clone of an exchange takes hours, not days. Google's Threat Analysis Group recently found iOS malware targeting crypto wallet apps including Coinbase and MetaMask, showing that attacks on crypto users span everything from sophisticated nation-state malware to $10 phishing domains.
The pattern is consistent: as crypto adoption grows in a market, so does the volume of scams targeting that market's users. India, with an estimated 100 million crypto holders, is a prime target.
Bitcoin traded at $69,203 and ETH at $2,111 as of March 22, 2026, with the broader market in a fear-driven pullback (Fear & Greed Index: 28). None of this is directly related to the CoinDCX case, but a fearful market tends to correlate with increased scam activity as desperate investors become easier targets for too-good-to-be-true pitches.
Overview
CoinDCX co-founders Sumit Gupta and Neeraj Khandelwal were questioned by Mumbai police on March 21 after an FIR was filed by a fraud victim who lost Rs 71 lakh (~$85,000) to a fake website impersonating the exchange. CoinDCX denies involvement, says the fraud was perpetrated by impersonators using cloned branding, and reports finding 1,212 fake websites in under two years. The company was already dealing with fallout from a $44 million hack in July 2025. The investigation is ongoing.
