INDUSTRY FACT FILE · BLOCKCHAIN, WEB3 & VIRTUAL DIGITAL ASSETS

Industry Overview: Blockchain, Web3 and Digital Assets in India

Who runs India's VDA exchanges, custody, Web3 and blockchain platforms, the obligations that apply, who buys cybersecurity in the sector and why each segment needs its own approach.

India treats crypto-assets and similar tokens as virtual digital assets (VDAs), a category the Finance Act 2022 inserted into the Income-tax Act 1961 as section 2(47A). The same Act taxed income from transferring VDAs at a flat 30% and, from 1 July 2022, required 1% tax to be deducted at source on transfers; the Income-tax Act 2025, in force from 1 April 2026, carries the regime forward. On 7 March 2023 the Ministry of Finance notified the VDA activities that make a business a reporting entity under the Prevention of Money-laundering Act 2002 when carried out for or on behalf of others: exchanging VDAs with fiat currency or with one another, transferring them, safekeeping or administering them or the instruments that control them, and providing financial services for an issuer's offer and sale. The government said in October 2025 that 50 VDA service providers had registered with FIU-IND and that notices had been issued to 25 offshore providers, following earlier notices to nine offshore exchanges in December 2023 and a request to block their websites. Around the exchanges, brokers, custodians and wallet providers sits a wider ecosystem of Web3 and DeFi projects built by Indian developers, NFT and gaming platforms, enterprise and government blockchain applications supported by MeitY's National Blockchain Framework of September 2024, and the Reserve Bank of India's e-rupee pilots, which began with a wholesale pilot in November 2022.

Digital asset businesses are among the most targeted organisations in the world because a stolen key is stolen money, and blockchain transactions cannot be recalled once confirmed. Chainalysis's 2026 Crypto Crime Report estimates that more than US$3.4 billion was stolen in crypto thefts in 2025 and attributes at least US$2.02 billion of it to hackers linked to North Korea. The largest single theft, about US$1.5 billion from the exchange Bybit on or about 21 February 2025, was attributed by the FBI to the North Korean activity it calls TraderTraitor. Investigators found that malicious code had been injected into a third-party multisig wallet interface through a compromised developer machine, so that signers saw a routine transfer while the transaction they approved handed control of the cold wallet to the attacker. Earlier cases follow similar paths. In March 2022 attackers gained control of five of the nine validator keys securing the Ronin bridge and withdrew assets then worth more than US$600 million, a theft the FBI attributed to the Lazarus Group; flaws in smart contract code let attackers drain about US$320 million from the Wormhole bridge in February 2022 and about US$190 million from the Nomad bridge after a faulty upgrade in August 2022. The weakest points are rarely the cryptography itself: they are signing screens, hot wallet servers, exposed credentials, upgrade processes, phished staff and third-party tools.

India has seen the same pattern. On 18 July 2024 WazirX, then one of India's largest exchanges, lost more than US$230 million from a multisig wallet. The exchange said the transaction its signers approved did not match what the custody interface displayed; its custody provider, Liminal, said its own platform had not been breached; and researchers including Elliptic attributed the attack to North Korea-linked actors. The stolen assets were reported to amount to about 45% of the exchange's holdings, withdrawals were frozen, and recovery for users came to depend on a restructuring scheme that the Singapore High Court sanctioned in October 2025. A year later, in July 2025, CoinDCX disclosed that about US$44 million had been taken from an internal operational account used for liquidity provision on a partner exchange, and said customer funds were unaffected and the loss would be covered from its treasury. Regulators have acted on compliance failures too: FIU-IND imposed penalties of ₹18.82 crore on Binance in June 2024 and ₹9.27 crore on Bybit in January 2025 for serving Indian users without registering as reporting entities and for related PMLA contraventions.

The obligations are now detailed and increasingly technical. FIU-IND's AML and CFT Guidelines for reporting entities providing VDA services, updated on 8 January 2026 to replace the March 2023 version, cover registration with FIU-IND, a Principal Officer based in India, customer due diligence with liveness-checked selfies, geo-location and IP capture and penny-drop bank verification, real-time travel rule information for transfers, risk assessment of transfers involving unhosted wallets, no facilitation of mixers or anonymity-enhancing tokens, tamper-proof audit trails and an annual independent audit of AML controls. An FIU-IND circular of 15 September 2025, as widely reported, made a cyber security audit certificate from a CERT-In empanelled auditor a condition of registration and continued registration. CERT-In's Directions of April 2022 require virtual asset service providers, exchanges and custodian wallet providers to keep KYC information and transaction records for five years, besides six-hour incident reporting and 180-day log retention, and CERT-In's audit guidelines of July 2025 set out how independent audits should be run. The DPDP Act 2023 and its Rules cover the large volumes of KYC and personal data these businesses hold, and exchanges serving users abroad also face regimes such as the EU's Markets in Crypto-Assets Regulation and FATF-based travel rules.

Figure 1: India's blockchain, Web3 and virtual digital asset ecosystem.

• The Ministry of Finance frames VDA policy and taxation, and FIU-IND registers VDA service providers as reporting entities, issues AML and CFT guidelines, receives suspicious transaction reports and imposes penalties under the PMLA.
• CBDT administers the VDA tax and TDS regime; the Enforcement Directorate investigates money laundering; state police cyber cells handle frauds and thefts reported by users and firms.
• The Reserve Bank of India runs the e-rupee pilots and oversees the banks and payment providers that VDA businesses depend on for rupee deposits and withdrawals.
• CERT-In receives incident reports and issues advisories and audit guidelines; MeitY and NIC run the National Blockchain Framework and act on website blocking requests under the IT Act.
• Exchanges, brokers, custodians and wallet providers hold customer funds and keys; Web3 and DeFi teams, NFT and gaming platforms publish smart contracts and token-based products.
• Banks, payment partners, analytics, KYC and travel rule vendors, node and RPC providers and wallet tooling suppliers sit inside almost every transaction, and their weaknesses become the platform's incidents.

Codec Networks is a CERT-In empanelled information security auditing organisation, empanelled with NICSI for application audit and compliance services (start-up category), and certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018. For blockchain, Web3 and VDA businesses we deliver smart contract audits for Ethereum, Solana and Polygon projects using manual review with tools such as Slither, Mythril and fuzzing, DeFi economic, oracle and upgrade risk reviews, hot, warm and cold wallet, MPC, multisig, HSM and signing policy reviews, VAPT of exchange web and mobile apps, APIs, nodes, RPCs and cloud estates, red teaming of withdrawal paths, CERT-In empanelled cyber security audits that support FIU-IND registration, reviews of AML, travel rule and record-keeping controls under the FIU-IND Guidelines, ISO 27001 and SOC 2 readiness, DPDP programmes for KYC data, 24x7 managed SOC with on-chain and wallet monitoring and transaction simulation tools such as Tenderly, and blockchain and crypto forensics with Chainalysis-supported fund tracing after a theft. Each proposal confirms auditor eligibility and independence against FIU-IND's, CERT-In's and the client's requirements. Codec Networks works strictly on security and compliance and does not advise on any token, asset or investment.

Note: This document is general industry guidance based on public information available as of October 2026. It is not legal, tax, regulatory or investment advice, and nothing in it recommends or endorses any virtual digital asset, token, exchange or platform. Obligations differ by activity (exchange, transfer, safekeeping or issuer-related services), FIU-IND registration status, the users and countries served, listing status, contracts and the data each organisation handles; confirm them against the official Ministry of Finance, FIU-IND, CBDT, CERT-In, RBI, MeitY and Data Protection Board instruments and your agreements. Incident references are summarised from official statements and widely reported events; attributions are those made by the authorities or researchers named.