India’s Enforcement Directorate (ED) searched premises linked to CoinDCX and Delta Exchange India over alleged breaches of foreign exchange rules involving unauthorized cross-border crypto transactions.
The searches took place on November 4 and 5. Officials visited three premises in Bengaluru connected to Neblio Technologies, the company behind CoinDCX, and Excelium Technologies, which operates Delta Exchange India.
ED Alleges FEMA Violations Worth Billions
The investigation is being conducted under Section 37 of the Foreign Exchange Management Act (FEMA), 1999, which governs cross-border financial transactions. The ED said both exchanges allegedly moved customer funds overseas to facilitate derivatives trading and exposure to tokenized shares of foreign companies without the required authorization.
The agency described three main ways CoinDCX allegedly handled these transactions. For some spot trades, the exchange reportedly converted customers’ rupees into $USDT and transferred the stablecoins to overseas platforms, including Binance, KuCoin and Gate.io, to execute orders. The ED alleged that these transactions bypassed India’s prescribed foreign exchange framework and went through an account belonging to a Costa Rica-based entity that the agency described as a paper company.
The agency claimed that trades were actually executed directly through CoinDCX using application programming interfaces (APIs). A similar arrangement allegedly applied to futures and options trading, with customer positions on the crypto exchange mirrored one-for-one on overseas exchanges such as Binance, KuCoin, Bybit and Gate.io.
The ED also questioned CoinDCX’s tokenized stock offerings, which provided exposure to companies such as Apple, Google and Tesla. The agency alleged that these products were actually derivatives trades executed on Hyperliquid, with customer funds converted into $USDT before matching positions were opened overseas. It said each of the three transaction channels involved tens of billions of rupees.
The agency also alleged that CoinDCX maintained enterprise accounts on foreign crypto exchanges, held crypto assets through them and paid billions of rupees in transaction fees. It said the payments, made using stablecoins such as $USDT and recorded as business expenses, violated FEMA requirements.
You may also like:
- Report: Democrats Weigh New Crypto Market Structure Bill
- Crypto Firms Under Attack: AI-Assisted CRAFTY FALCON Exploits Systems to Steal Digital Assets
- CLARITY Act Could Be Delayed 2 Years After Republican Midterm Losses, Analyst Says
Delta Exchange India is also under investigation. The ED said the platform offered spot trading, futures, options and tokenized shares of foreign companies. Investigators allegedly found, however, that much of its derivatives and tokenized stock trading went through CoinDCX, which then executed orders on overseas platforms. The agency valued these transactions at several tens of billions of rupees and is separately examining billions of rupees that Delta allegedly sent to overseas associate entities.
The ED added that the exchanges’ products may also conflict with provisions of the Securities Contracts (Regulation) Act, the SEBI Act and the RBI Act. Both companies have acknowledged the visits and disputed the allegations. CoinDCX called the search part of a routine inquiry and said it fully cooperated with officials.
Security Troubles
CoinDCX faced another security controversy in October 2026, more than a year after it lost around $44 million in a cyberattack on July 19, 2025. The earlier breach targeted an internal liquidity-provisioning account. The exchange said customer funds in cold wallets were unaffected and that it covered the loss from its own reserves.
On October 21, around 15.99 million $USDT, along with small amounts of TRX, moved from Tron addresses linked to CoinDCX to external platforms, including Binance and OKX. The exchange initially denied that its active wallets had been breached and blamed a failure involving old deposit addresses compromised in the 2025 attack.
Blockchain investigators, including ZachXBT, questioned that explanation. CoinDCX later acknowledged the loss in a blog post, saying some customers had continued depositing funds into addresses that were supposed to have been retired.

