India's ED Probes CoinDCX, Delta Over Billions in Suspected Offshore Trading

Indian Authorities Probe Crypto Exchanges for Alleged Foreign Exchange Rule Violations

India’s Enforcement Directorate (ED) has conducted searches at premises associated with cryptocurrency exchanges CoinDCX and Delta Exchange India, citing alleged violations of foreign exchange regulations concerning unauthorized cross-border crypto transactions.

The searches, which took place on November 4 and 5, involved officials visiting three locations in Bengaluru. These sites are linked to Neblio Technologies, the parent company of CoinDCX, and Excelium Technologies, the operator of Delta Exchange India.

The investigation is being carried out under Section 37 of the Foreign Exchange Management Act (FEMA), 1999, which governs international financial dealings. The ED alleges that both exchanges facilitated the movement of customer funds abroad to enable derivatives trading and provide exposure to tokenized foreign company shares without the necessary approvals.

Allegations Against CoinDCX

According to the ED, CoinDCX allegedly employed three primary methods for these transactions. For certain spot trades, the exchange reportedly converted customer rupees into USDT (Tether) and transferred these stablecoins to international platforms, including Binance, KuCoin, and Gate.io, to execute trades. The ED claims these transactions circumvented India’s foreign exchange framework and were channeled through an account belonging to a Costa Rica-based entity described as a shell company.

The agency further asserted that these trades were effectively executed directly via CoinDCX using application programming interfaces (APIs). A similar arrangement was allegedly in place for futures and options trading, where customer positions on the crypto exchange were mirrored on foreign exchanges such as Binance, KuCoin, Bybit, and Gate.io.

The ED also scrutinized CoinDCX’s tokenized stock offerings, which provided exposure to companies like Apple, Google, and Tesla. The agency alleged that these products were, in reality, derivatives trades executed on Hyperliquid, with customer funds converted to USDT before matching positions were established overseas. The ED stated that each of these three transaction channels involved sums in the tens of billions of rupees.

Furthermore, the ED accused CoinDCX of maintaining corporate accounts on foreign crypto exchanges, holding crypto assets through these accounts, and incurring billions of rupees in transaction fees. These payments, made using stablecoins like USDT and recorded as business expenses, are alleged to have contravened FEMA requirements.

Delta Exchange India Under Scrutiny

Delta Exchange India is also a subject of the probe. The ED indicated that the platform offered spot trading, futures, options, and tokenized shares of foreign companies. However, investigators reportedly discovered that a significant portion of its derivatives and tokenized stock trading was routed through CoinDCX, which then executed the orders on international platforms. The agency estimated the value of these transactions to be in the tens of billions of rupees and is conducting a separate examination of billions of rupees that Delta allegedly transferred to overseas associate entities.

The ED also suggested that the products offered by these exchanges might conflict with provisions of the Securities Contracts (Regulation) Act, the SEBI Act, and the RBI Act.

Both CoinDCX and Delta Exchange India have acknowledged the visits by the ED but have refuted the allegations. CoinDCX characterized the search as part of a routine inquiry and affirmed its full cooperation with officials.

This investigation follows a separate security incident involving CoinDCX in October 2026. More than a year after losing approximately $44 million in a cyberattack on July 19, 2025, which targeted an internal liquidity-provisioning account, the exchange reported another movement of funds. On October 21, around 15.99 million USDT, along with smaller amounts of TRX, were transferred from Tron addresses linked to CoinDCX to external platforms, including Binance and OKX. Initially, the exchange denied any breach of its active wallets, attributing the movement to a failure involving older deposit addresses compromised in the 2025 attack. Blockchain investigators, including ZachXBT, questioned this explanation. CoinDCX later admitted to the loss in a blog post, stating that some customers had continued depositing funds into addresses that were supposed to have been retired.