If an exchange loses billions to hackers, who protects your money in India?
On 29 October 2026, hackers stole about US$6.3 billion from the crypto exchange Binance. Reports call it the largest crypto theft on record. It beat the roughly US$1.5 billion Bybit hack of February 2025. (Source: Reuters) (Source: FBI)
This lesson asks a simple question. What rules does India have for crypto, and what do they not cover? We also look at the WazirX hack and the Digital Rupee.
- VDA: India’s tax-law term for crypto-assets and similar digital tokens.
- Tax: 30% on transfer income and 1% TDS on the sale amount.
- AML: crypto service providers must register with FIU-IND.
- Gap: no comprehensive crypto law as of November 2026.
- Digital Rupee: RBI-issued, so not a private cryptocurrency.
Must Know: Understand the Words
1.What is a crypto-asset, and what is a VDA?
A crypto-asset is a digital record of value secured by cryptography. Many run on a blockchain, a shared record kept by many computers. (Source: IMF)
Bitcoin is a cryptocurrency. A stablecoin tries to hold a steady value against another asset.
Indian tax law uses a wider term, virtual digital asset (VDA). It covers qualifying tokens and NFTs. Indian and foreign currency, and CBDCs, are excluded. (Source: Income Tax Department)
Check 1
A VDA includes the Digital Rupee issued by RBI.
2.How does an exchange get hacked?
A hack need not break the blockchain itself. Binance gave an early finding: a compromised DevOps engineer’s laptop was one part of a wider attack. Attackers also manipulated a transaction-approval system to move funds from a hot wallet. (Source: BleepingComputer)
A hot wallet is a wallet connected to the internet. This is a preliminary company finding, not a final forensic report.
Good to Know: India’s Rules
3.What did the RBI circular and the Supreme Court do?
On 6 April 2018, RBI barred its regulated entities from dealing in virtual currencies. (Source: Supreme Court)
On 4 March 2020, the Supreme Court set that circular aside in IAMAI v. RBI. It used the test of proportionality.
Check 2
In 2020 the Supreme Court made Bitcoin legal tender.
4.How is crypto taxed?
Section 115BBH, added by the Finance Act 2022, taxes income from VDA transfers at 30%. Only the cost of acquisition can be deducted. Losses cannot be set off or carried forward. (Source: Income Tax Department)
Section 194S asks for 1% TDS on the sale amount, not just the profit. The limits are Rs 50,000 for a specified person and Rs 10,000 for others. (Source: Income Tax Department)
The Income-tax Act 2025 took effect on 1 April 2026. It keeps the 30% rate in section 194 (Table item 4) and the 1% TDS in section 393(1) (Table item 8(vi)). (Source: PIB)
Crypto-asset reporting began on 1 April 2026 under section 285BAA of the 1961 Act. The matching section in the 2025 Act is section 509. (Source: Income Tax Department)
Check 3
The 1% TDS on crypto applies only to the profit made.
5.What is the PMLA and FIU-IND role?
A notification of 7 March 2023 brought VDA service providers under the Prevention of Money Laundering Act (PMLA). They must register with the Financial Intelligence Unit (FIU-IND). Offshore providers serving India are included. (Source: FIU-IND)
On 19 June 2024, FIU-IND fined Binance Rs 18.82 crore for PMLA failures. (Source: FIU-IND order)
Registration is an anti-money-laundering duty. It does not make a crypto product safe.
6.Is there a crypto law yet?
No. On 9 September 2026 the Finance Ministry said crypto products and NFTs are unregulated. FIU-IND also sent notices to 15 VDA service providers. (Source: PIB)
No comprehensive crypto law had been enacted by November 2026.
Great to Know: Hacks and Global Rules
7.What happened at WazirX?
WazirX, an Indian exchange, lost about US$235 million in a wallet breach on 18 July 2024. (Source: Bloomberg Law)
On 14 January 2025, the US and South Korea linked it to North Korea in a joint statement with Japan. (Source: MediaNama)
WazirX restarted operations on 24 October 2025. A restart is not full recovery of the stolen assets. (Source: Economic Times)
UN experts probed 58 suspected North Korean crypto attacks from 2017 to 2023. The value was about US$3 billion. This is a 2024 figure, not a current total. (Source: AP)
Check 4
The 14 January 2025 statement linked the WazirX theft to North Korea.
8.What do the G20, IMF, FSB and FATF say?
The IMF and FSB published a synthesis paper on 7 September 2023 at the request of India’s G20 presidency. It urges coordinated rules for crypto-assets. (Source: FSB)
The FATF Travel Rule says sender and receiver details must travel with a crypto transfer. It has nothing to do with passenger travel. The FSB found significant gaps in its use in October 2025. (Source: FSB)
9.How is the Digital Rupee different?
The Digital Rupee (e₹) is a central bank digital currency issued by RBI. The wholesale pilot began on 1 November 2022 and the retail pilot on 1 December 2022. (Source: PIB)
For more, read Digital Rupee / Central Bank Digital Currency and the Emerging Tech Glossary: Metaverse, Web3, Digital Twin, NFT.
Exam Practice: How This Is Tested
- Court trap: the 2020 judgment did not legalise crypto.
- Tax trap: 30% is on transfer income; 1% TDS is on the sale amount.
- Safety trap: FIU registration does not guarantee safe investments.
- Currency trap: the Digital Rupee is not a private cryptocurrency.
Mains practice: How should India handle crypto exchange risks while protecting monetary sovereignty and supporting innovation? Separate tax, AML rules, exchange security and customer protection.
Check 5
Registering with FIU-IND is an anti-money-laundering duty, not a safety guarantee.
Latest News on Crypto
Newest first.
- [Mains Fodder] 2 November 2026: Reuters reported Binance outflows stabilising. Binance said it had replaced about US$6 billion (about 95%) from company funds. This is a company claim, not an audit. (Source: Reuters) So what: Company assurances differ from independently proven recovery.
- [First] 1 November 2026: Binance resumed withdrawals in phases. Net outflows were about US$3.64 billion in the initial window, as the company reported. (Source: UPI) So what: It shows how fast customers pull money after a breach.
- [First] 31 October 2026: The FBI attributed the Binance theft to North Korea’s TraderTraitor group. (Source: BleepingComputer) So what: State-linked hacking turns exchange security into a national security issue.
- [First] 29 October 2026: Binance suffered a theft of about US$6.3 billion. (Source: Reuters) So what: It is the largest crypto theft reported so far.
- [Policy] 9 September 2026: FIU-IND sent notices to 15 VDA service providers. The Finance Ministry called crypto products and NFTs unregulated. (Source: PIB) So what: AML oversight exists, but product regulation does not.
- [Policy] 1 April 2026: The Income-tax Act 2025 took effect. (Source: PIB) So what: Learn both the old and new section numbers.
- [Policy] 24 October 2025: WazirX restarted operations after its 2024 breach. (Source: Economic Times) So what: A restart does not mean victims are fully repaid.
- [First] 21 February 2025: Bybit lost about US$1.5 billion. The FBI blamed North Korea on 26 February 2025. (Source: FBI) So what: This was the record that Binance’s theft later passed.
Check 6
Binance has proven that every stolen rupee, dollar or coin was repaid.
MCQ on Cryptocurrency Regulation in India
0 of 5 answered Question 1 of 5 Question 2 of 5 Question 3 of 5 Question 4 of 5 Question 5 of 5
Share your thoughts