Delta

Neblio

India’s Enforcement Directorate (ED) has searched premises linked to CoinDCX and Delta Exchange India over alleged violations of foreign exchange rules involving unauthorized cross-border crypto transactions.
The searches took place on November 4 and 5, when officials visited three premises in Bengaluru connected to Neblio Technologies, the company behind CoinDCX, and Excelium Technologies, which operates Delta Exchange India.
<h2 id="ed-flags-alleged-fema-violations-worth-billions">ED Flags Alleged FEMA Violations Worth Billions</h2>
The investigation is being <a href="https://x.com/dir_ed/status/2120761895091384503" rel="noopener noreferrer nofollow">conducted</a> under Section 37 of the Foreign Exchange Management Act (FEMA), 1999, which governs cross-border financial transactions. According to the ED, both exchanges allegedly moved customer funds overseas to facilitate derivatives trading and exposure to tokenized shares of foreign companies without the required authorization.
The agency outlined three main routes through which CoinDCX allegedly handled these transactions. For certain spot trades, the exchange reportedly converted customers’ rupees into USDT and transferred the stablecoins to overseas platforms, including Binance, KuCoin and Gate.io, to execute orders. The ED alleged that these transactions bypassed India’s prescribed foreign exchange framework and were routed through an account belonging to a Costa Rica-based entity that it described as a paper company.
The agency claimed the trades were actually executed directly through CoinDCX using application programming interfaces (APIs). A similar arrangement allegedly existed for futures and options trading, where customer positions on the crypto exchange were mirrored one-for-one on foreign exchanges such as Binance, KuCoin, Bybit and Gate.io.
The ED also questioned CoinDCX’s tokenized stock offerings, which included exposure to companies such as Apple, Google and Tesla. It alleged that these products were actually derivatives trades executed on Hyperliquid, and customer funds were converted into USDT before matching positions were opened overseas. The agency said each of the three transaction channels involved tens of billions of rupees.
It also alleged that CoinDCX maintained enterprise accounts on foreign crypto exchanges, held crypto assets through them, and paid billions of rupees in transaction fees. The agency said these payments, made through stablecoins such as USDT and recorded as business expenses, violated FEMA requirements.
Delta Exchange India is also part of the probe. The ED said the platform offered spot trading, futures, options and tokenized shares of foreign companies. However, investigators allegedly found that much of its derivatives and tokenized stock trading was routed through CoinDCX, which then executed the orders on overseas platforms. The agency put the value of these transactions at several tens of billions of rupees and is separately examining billions of rupees Delta allegedly sent to overseas associate entities.
The ED added that the exchanges’ products may also conflict with provisions of the Securities Contracts (Regulation) Act, the SEBI Act and the RBI Act. Both companies have acknowledged the visits but pushed back against the allegations. CoinDCX <a href="https://x.com/CoinDCX/status/2118782238716494314" rel="noopener noreferrer nofollow">described</a> the search as part of a routine inquiry and said it fully cooperated with officials.
<h2 id="security-troubles">Security Troubles</h2>
CoinDCX faced another security controversy in October 2026, more than a year after <a href="https://cryptopotato.com/coindcx-software-engineer-arrested-in-connection-to-44-million-hack-report/" rel="noopener noreferrer nofollow">losing</a> around $44 million in a cyberattack on July 19, 2025. The earlier breach targeted an internal liquidity-provisioning account, but the exchange said customer funds in cold wallets were unaffected and it covered the loss using its own reserves.
On October 21, around 15.99 million USDT, along with small amounts of TRX, moved from Tron addresses linked to CoinDCX to external platforms, including Binance and OKX. The exchange initially denied any breach of its active wallets and blamed a failure involving old deposit addresses compromised in the 2025 attack.
Blockchain investigators, including ZachXBT, questioned the explanation. CoinDCX later <a href="https://cryptopotato.com/coindcx-admits-16m-loss-just-days-after-ceo-denied-fresh-wallet-breach/" rel="noopener noreferrer nofollow">acknowledged</a> the loss in a blog post, saying some customers had continued depositing funds into addresses that were supposed to have been retired.
The post <a href="https://cryptopotato.com/indias-ed-targets-coindcx-and-delta-over-billions-in-alleged-unauthorized-overseas-trades/" rel="noopener noreferrer nofollow">India’s ED Targets CoinDCX and Delta Over Billions in Alleged Unauthorized Overseas Trades</a> appeared first on <a href="https://cryptopotato.com/" rel="noopener noreferrer nofollow">CryptoPotato</a>.

India’s ED Targets CoinDCX and Delta Over Billions in Alleged Unauthorized Overseas Trades

Table of Contents

CryptoPotato_News

Other articles published on Nov 12, 2026

Join our free newsletter for daily crypto updates!