⚠️ DISCLAIMER: Ministry of Cyber Affairs is an independent news, guides and directory service on cybercrime and cybersecurity, for victims and investigators. It is NOT an official government or ministry portal.
Website Scam CheckerNew
Back to News

How Crypto Trades are used in Cross Border Money Laundering - India's ED Investigation Reveals

6 November 2026
Source:Directorate of Enforcement, Bengaluru Zonal Office
Share
How Crypto Trades are used in Cross Border Money Laundering - India's ED Investigation Reveals

The Enforcement Directorate has searched three Bengaluru premises linked to CoinDCX and Delta Exchange under FEMA, 1999, over alleged unauthorised cross-border crypto transactions. The ED said INR deposits were converted to USDT and routed through a Costa Rica paper entity to Binance, KuCoin, Bybit, Gate.io and Hyperliquid for spot, futures and options, and tokenised foreign stock trades, with volumes running into thousands of crores of rupees.

The Enforcement Directorate (ED), Bengaluru Zonal Office, has searched three premises in Bengaluru linked to two Indian crypto platforms. They are CoinDCX, operated by Neblio Technologies Pvt Ltd, and Delta Exchange, operated by Excelium Technologies Pvt Ltd. The searches, on 4 and 5 November 2026, were carried out under Section 37 of the Foreign Exchange Management Act (FEMA), 1999. They concern alleged unauthorised cross-border transactions in crypto derivatives and Real World Asset (RWA) tokens.

According to the ED's press release of 6 November, both platforms offered crypto futures and options and openly advertised trading in tokenised stocks of foreign companies, despite allegedly not being authorised to do so. The agency said its enquiries found that user funds were converted into stablecoins such as USDT and used to trade on foreign crypto exchanges, including Binance, KuCoin, Gate.io and Bybit.

The ED's press release included these advertisements posted by the platforms:

The ED said the volume of these cross-border transactions runs into thousands of crores of rupees in each product line.

Modus Operandi 1: Spot Trading

The ED said user money on CoinDCX was routed abroad to fill spot orders, as follows:

  1. The user deposits Indian rupees (INR) on the platform and places a spot order for a crypto token.
  2. The INR is converted into USDT.
  3. The USDT is sent to Binance, KuCoin, Gate.io and similar exchanges to execute the order.
  4. The transfers go through an account on those exchanges held in the name of a Costa Rica-based entity. The ED described it as a paper entity, used to get around the framework for cross-border money transfers.
  5. The trades are executed directly from CoinDCX through Application Programming Interfaces (APIs).

Modus Operandi 1 - Spot Trading

Modus Operandi 2: Futures and Options

The ED said CoinDCX's futures and options products were in fact being executed on foreign exchanges:

  1. The user deposits INR on CoinDCX and opens a futures or options position.
  2. CoinDCX opens a matching one-to-one position on Binance, KuCoin, Bybit or Gate.io, through the account held in the Costa Rica entity's name.
  3. The trades run directly from CoinDCX through APIs.
  4. When the user closes the position, the foreign position is also closed, and settlement takes place on the foreign platform.

Modus Operandi 2 : Future and Option based Money Laundering

Modus Operandi 3: Tokenised Stocks

CoinDCX offered trading in tokenised stocks of foreign companies such as Apple, Google and Tesla. The ED said this was actually derivative trading on Hyperliquid, a foreign decentralised crypto trading platform. The user did not own the underlying stock.

  1. The user deposits INR on CoinDCX and places an order for a "global futures stock".
  2. CoinDCX converts the funds into USDT and opens a matching one-to-one position on Hyperliquid.
  3. When the user closes the position, the Hyperliquid position is also closed, and settlement takes place there.

Modus Operandi 3 : Tokenised stocks

Other Findings Against CoinDCX

The ED said CoinDCX holds enterprise trading accounts on foreign crypto platforms, keeping crypto assets abroad in contravention of FEMA. It also said the platform pays hundreds of crores of rupees in transaction fees to foreign exchanges, routed in USDT and not through the channels FEMA allows.

Delta Exchange India

The ED said Delta Exchange India, run by Excelium Technologies, offers spot, futures and options trading in crypto tokens and trading in tokenised foreign stocks. Searches at two of the group's premises found, according to the agency:

  • A large share of Delta Exchange India's derivative trading, including futures, options and tokenised stocks, was routed through CoinDCX.
  • CoinDCX in turn placed these trades on Binance, KuCoin, Gate.io, Bybit and other foreign platforms, in contravention of FEMA.
  • The volume of these cross-border transactions runs into several thousand crores of rupees.
  • Hundreds of crores of rupees were transferred by Delta Exchange India to associate entities abroad. This is under investigation.

Securities and RBI Laws Also Under Examination

The ED said the products offered by both platforms appear, prima facie, to be contrary to the Securities Contracts (Regulation) Act, 1956, the SEBI Act, 1992 and the RBI Act, 1934. These aspects are being examined further.

The findings are the ED's allegations at the search stage. No charges have been filed, and neither company's response was available at the time of publishing. Further investigation is under progress.

More in Cybercrime Trends

Related articles

Cybercrime Trends (News)

India's UP Police Arrest Man Accused of Running Telegram Groups to Share Child Sexual Abuse Material, Acting on NCMEC CyberTipline Alert

Police in Bhadohi, in India's Uttar Pradesh state, have arrested a 27-year-old man accused of creating multiple Telegram groups to collect and share child sexual abuse material (CSAM). The case began with a CyberTipline report received at Koirauna police station. An FIR was registered under India's IT Act, the POCSO Act and the Bharatiya Nyaya Sanhita. Officers recovered a Redmi (Xiaomi 15) phone said to have been used in the offence. The arrest was made on 10 November 2026.

12 Nov 2026
Cybercrime Trends (News)

India's ED Arrests Crypto Founder Over Betting and Cyber-Fraud Laundering via Jubilee Hills Mercantile Co-operative Bank, Nagarbhavi Credit Society

India's Enforcement Directorate has arrested Sagar Dash, founder of Armstrong Exchange Pvt Ltd, in its money laundering probe into the All Panel Exchange (APX) betting platform. ED alleges victims' money moved through mule accounts at Jubilee Hills Mercantile Co-operative Bank, Hyderabad, and shell firms into an account at Nagarbhavi Credit Co-operative Society, Bengaluru, and that Dash used the society's KYC and forged papers to open a crypto account. About $960,000 is frozen.

11 Nov 2026
Cybercrime Trends (News)

India's Enforcement Directorate Seizes $1.5 Million in HashPe Crypto Ponzi That Promised 1% Daily Returns; Four Promoters in Custody

India's Enforcement Directorate has provisionally attached assets worth about $1.5 million (Rs 14.16 crore) in the HashPe cryptocurrency investment case and filed charges before a special money laundering court in Puducherry. Run through hashpe.io and a multi-level marketing network, the scheme raised about $12 million by promising 1% daily returns, trading fictitious coins and paying earlier investors with new money. Four accused are in judicial custody.

11 Nov 2026