India’s Enforcement Directorate (ED) searched three premises in Bengaluru on November 4 and 5 linked to Neblio Technologies, the company behind CoinDCX, and Excelium Technologies, which operates Delta Exchange India. The searches are part of an active investigation under Section 37 of the Foreign Exchange Management Act (FEMA), 1999 into alleged unauthorized cross-border financial transactions involving crypto derivatives and real-world asset tokens.
The ED alleges that CoinDCX converted customer rupee deposits into USDT and routed the stablecoins to overseas platforms, including Binance, KuCoin, Gate.io and Bybit, to execute spot orders. Futures and options positions were allegedly mirrored one-for-one on foreign venues through an account tied to a Costa Rica-based entity that investigators described as existing only on paper. The agency also claims CoinDCX maintained enterprise accounts on foreign platforms and paid transaction fees abroad using USDT, with transaction volumes running into thousands of crores of rupees.
The probe also covers tokenized stock offerings linked to companies such as Apple, Google and Tesla. Authorities allege these products were derivative positions executed on Hyperliquid, rather than purchases of underlying shares, and that customer funds were converted into USDT before matching positions were opened overseas. Delta Exchange India faces separate allegations that much of its derivatives and tokenized-stock activity was routed through CoinDCX and then executed on foreign platforms. The ED is examining transfers to overseas associate entities and whether the products conflict with India’s Securities Contracts (Regulation) Act, SEBI Act and RBI Act.
Both companies have disputed the allegations. CoinDCX said it complied with Indian law, described the searches as part of a routine inquiry and said operations remained normal. Delta Exchange denied cross-border virtual digital asset transfers. The allegations remain under investigation and do not constitute findings of guilt.
Separately, CoinDCX has faced security scrutiny after a July 2025 cyberattack that caused a loss of about $44 million, as well as an October 2026 movement of roughly 15.99 million USDT from Tron addresses linked to the exchange. The exchange said customer funds in cold wallets were unaffected by the earlier attack.
