If your crypto exchange gets hacked, immediately change your password and 2FA, revoke all API keys, screenshot your full portfolio balance with timestamps, and email the exchange a formal preservation request. Do not wait for official confirmation. The first hour determines whether you protect linked accounts and build the evidence needed for any compensation claim.
- Act within the first hour: Secure your email, revoke API keys, and document your balance with timestamps.
- Do not panic-withdraw blindly: Mid-hack withdrawals can fail or get flagged; read the exchange’s official channels first.
- Preserve evidence: Screenshots, transaction IDs, and email confirmations are your legal ammunition later.
- Indian users have escalation paths: FIU-IND, consumer courts, and CERT-In complaints are all available options.
- Compensation is possible but slow: The WazirX hack showed Indian users can wait months or years for partial recovery.
What to Do If Your Crypto Exchange Is Hacked: First 24-Hour Action Checklist
Speed matters more than anything else in the first few hours when a crypto exchange gets hacked. Your goal is not to recover funds immediately. It is to stop further damage and build a paper trail that supports any future claim.
Hour 0 to 2: Secure Everything Linked to the Account
Change your exchange password right now, even before you know the full story. Then rotate the password on the email address tied to that account. If you reuse the same password elsewhere, change those too.
Revoke all active API keys on the exchange. Hackers often exploit API access to drain accounts even after users believe they are safe. Check the exchange’s API management page and delete every active key you did not create in the last 24 hours.
Switch your 2FA to an authenticator app if you are still on SMS-based 2FA. SIM-swap attacks are common in India and can give attackers a second entry point. Exchanges like CoinDCX and ZebPay support app-based 2FA.
Hour 2 to 6: Document Your Losses
Take full screenshots of your portfolio page, open orders, transaction history, and any error messages. Export your full transaction history as a CSV if the platform still allows downloads. Save everything to Google Drive or a local folder with timestamps.
Note your exact INR equivalent balance at the time of the incident. Under India’s 30% VDA tax rules, you will need accurate cost-basis records for any insurance or legal claim. Your KYC documents on file with the exchange are also part of your evidence. Check that your KYC is complete and up to date so there is no dispute about your identity later.
Hour 6 to 24: File Your First Complaint
Email the exchange’s official support address with your account details, a summary of your holdings, and every screenshot you have taken. Use the subject line: “Hack Incident – Account Preservation Request – [Your User ID].” Keep a copy of every email you send.
Post on the exchange’s official social media only if the platform has gone silent. Public pressure has historically forced faster responses from Indian exchanges. The WazirX hack timeline shows exactly how user pressure shaped the recovery narrative over weeks.
Withdraw or Wait? How to Read the Situation When a Crypto Exchange Gets Hacked
This is the question every user asks, and the honest answer depends on what kind of hack it is.
When Withdrawing Makes Sense
If the exchange is still processing withdrawals and the hack appears to be a hot wallet breach that did not touch user balances directly, move your funds to a hardware wallet or a separate, unaffected exchange. Do not move to another hot wallet on the same platform.
Check whether the exchange has officially confirmed the hack. If they have not, and withdrawal queues are moving normally, a careful withdrawal is reasonable. But if the platform has paused withdrawals, attempting one may generate a failed transaction with no refund timeline.
When Waiting Is the Smarter Move
If the exchange has frozen withdrawals, waiting is not optional. Submitting multiple withdrawal requests can flag your account for manual review, which slows things down further.
Watch the exchange’s official Telegram, Twitter/X, and blog. Credible exchanges publish incident reports within 12 to 48 hours. If 72 hours pass with no official statement, that is a red flag. The Vauld crisis is a useful comparison: users who waited without filing claims early were disadvantaged in the restructuring process.
Compensation Precedents: What Happens After a Crypto Exchange Is Hacked
Indian users often ask whether they will actually get their money back. The honest answer is: sometimes, partially, and usually slowly.
The WazirX Case
In July 2024, WazirX suffered a hack where approximately $235 million in user assets were stolen, according to blockchain analytics firm Chainalysis, making it one of the largest exchange hacks in Indian crypto history. The platform subsequently suspended INR and crypto withdrawals and entered a restructuring process under Singapore’s legal framework. The full WazirX hack timeline covers how the recovery plan evolved and what users were offered.
WazirX proposed a socialized loss model, meaning all users absorbed a portion of the loss regardless of whether their specific assets were stolen. This was deeply unpopular but reflects a real industry pattern. Users who filed claims early and kept documentation were better positioned during the creditor process.
Global Comparison: Bybit 2025
Bybit suffered a $1.5 billion hack in February 2025, the largest in crypto history at that point, according to blockchain analytics firm Elliptic. Unlike WazirX, Bybit covered losses from its own reserves and kept withdrawals open within hours. This contrast shows that exchange solvency and transparency at the moment of crisis determine user outcomes more than any other factor.
For historical context, the Mt. Gox exchange lost approximately $450 million worth of Bitcoin in its 2014 collapse, according to the Chainalysis 2024 Crypto Crime Report. Users waited nearly 10 years for partial repayment, illustrating the worst-case timeline when a crypto exchange gets hacked and has no reserves to cover losses.
| Exchange | Hack Year | Amount Lost | Withdrawals Paused | User Compensation |
|---|---|---|---|---|
| WazirX | 2024 | ~$235 million | Yes, extended | Partial, via restructuring |
| Bybit | 2025 | ~$1.5 billion | No | Full, from reserves |
| Mt. Gox | 2014 | ~$450 million | Yes, permanent | Partial, after 10 years |
| Vauld | 2022 | Liquidity crisis | Yes | Ongoing restructuring |
Escalation Paths for Indian Users When a Crypto Exchange Gets Hacked
If the exchange stops communicating or your funds remain stuck for weeks, you have real escalation options in India. Use them in this order.
Step 1: File with FIU-IND
The Financial Intelligence Unit of India (FIU-IND) oversees Virtual Digital Asset Service Providers (VDASPs) under the Prevention of Money Laundering Act. Check whether your exchange is FIU-registered: unregistered platforms have far less accountability. You can file a complaint directly with FIU-IND if the exchange is registered and unresponsive.
Step 2: Report to CERT-In
The Indian Computer Emergency Response Team (CERT-In) handles cybercrime reports including exchange hacks. File an incident report at cert-in.org.in. This creates an official record that can support future legal action and puts the exchange on notice that authorities are aware.
Step 3: Consumer Court and Cybercrime Portal
File a complaint at cybercrime.gov.in under financial fraud. For amounts above Rs 20 lakh, consider engaging a lawyer and approaching the consumer disputes redressal commission. Keep in mind that crypto is not yet regulated by SEBI, so consumer protection frameworks are still being tested in this space.
India’s crypto regulatory landscape is evolving fast. The 1% TDS deducted on every transaction already creates a government record of your activity. Use those TDS records as supporting evidence in any claim you file after a crypto exchange gets hacked.
Frequently Asked Questions
What should I do first when my crypto exchange is hacked?
Change your exchange password and the password of the email linked to it immediately. Revoke all API keys on the platform. Take full screenshots of your balance and transaction history. File a support ticket with the exchange using your account ID and a timestamp. These steps protect you legally and stop secondary attacks on linked accounts.
Should I withdraw immediately when I hear hack rumours?
Not automatically. If withdrawals are still open and the hack appears limited to the exchange’s own wallets rather than user balances, a careful withdrawal to a personal wallet is reasonable. But if the platform has already paused withdrawals, submitting requests will not help and may complicate your account status. Verify through official channels before acting.
Will a hacked crypto exchange compensate Indian users?
It depends entirely on the exchange’s reserves and legal structure. Bybit covered its $1.5 billion 2025 hack from its own funds, according to Elliptic. WazirX offered a partial socialized loss recovery through a restructuring process. There is no legal guarantee in India yet. Filing claims early and preserving documentation significantly improves your position in any creditor or compensation process.
Can I claim tax relief in India if my crypto is stolen in an exchange hack?
India’s current VDA tax framework under Section 115BBH does not explicitly allow loss offsets from theft or hacks. You cannot set off a hack loss against other VDA gains under the 30% flat tax rule. However, keeping accurate cost-basis records and TDS certificates is still essential because the regulatory position may change and documentation supports any future legal or insurance claim.
How do Indian users escalate claims against a hacked exchange?
Start with a formal email complaint to the exchange. Then file with FIU-IND if the exchange is a registered VDASP. Report the cybercrime at cybercrime.gov.in and notify CERT-In. For large amounts, consult a lawyer about consumer court options. Keep records of every step because Indian regulators are still building enforcement frameworks for crypto disputes specifically.
Knowing what to do when your crypto exchange gets hacked is as important as knowing what coins to hold. The users who recovered the most from incidents like WazirX were those who documented early, escalated through official channels, and stayed patient through long restructuring timelines. Keep your funds spread across multiple platforms, use hardware wallets for long-term holdings, and always trade on FIU-registered exchanges that carry real regulatory accountability in India.
Crypto investments carry significant risk. The value of your holdings can fall to zero. This article is not financial or legal advice. Data as of July 2025. Last updated: July 2025. Reviewed by the CryptoWire editorial team.
