The massive CoindCX hack investigation led to a dramatic shift when police arrested CoindCX employees in connection with the robbery.
The employee was arrested for $44 million
🔸Employee Rahul Agarwal has been arrested. Malware found on his company’s laptop.
Hackers may have accessed the system via a malicious file sent to WhatsApp.
Credentials compromised, and funds moved to six crypto wallets.
agarwal’s claims…pic.twitter.com/cjudxbpnxf
– Karan Singh Arora (@thisisksa) July 31, 2025
Who was the employee and how was he involved?
The employee in question is Rahul Agarwal, a 30-year-old software engineer based in Bengaluru, a city known as India’s Silicon Valley. He was arrested by local police on July 26th.
Agarwal was a full-time employee of CoindCX and had been issued laptops restricted to office use. Following this, hackers discovered that using company-issued laptop login credentials in Agarwal’s single to access the system and emit $44 million in digital assets.
The theft occurred early on July 19th. However, the initial violation was identified when one USDT was transferred from the CoindCX platform to an external wallet.
Within hours, unauthorized transactions moved large sums to six different crypto wallets. Police say only Agarwal’s laptops were compromised during an internal check by CoindCX holding company Neblio Technologies.
What is his side of the story?
Agarwal was called for questions when Hardeep Singh, the company’s vice president, flagged suspicious activity.
He denied any involvement in the theft, but here it becomes interesting. He has admitted to freelance work for multiple private clients he claims he doesn’t know. He also told police he received WhatsApp calls from German numbers and files that may have breached his system.
evidence
Agarwal claims he is unaware of the hack, but police pointed out two important things that raised their suspicions. First, investigators revealed that Agarwal received an unexplained payment of $17,116 in his bank account from an unconfirmed source. The second was his unknown freelance work.
As the investigation continues to investigate whether this is the result of an external attack, an insider’s negligence, or a direct “duty,” police seized his device.
Disclaimer: The information contained in this article is for information and educational purposes only. This article does not constitute any kind of financial advice or advice. Coin Edition is not liable for any losses that arise as a result of your use of the content, products or services mentioned. We encourage readers to take caution before taking any actions related to the company.
Discover more from Earlybirds Invest
Subscribe to get the latest posts sent to your email.