The Indian Court Blocks WazirX from Using User XRP to Cover Losses from a Hack of $230M

The Madras High Court has ruled that digital assets qualify as properties under Indian law, blocking a certain platform from redistributing the XRP of a user to compensate for losses from a devastating cyber attack in 2024.

Judge N. Anand Venkatesh issued the ruling on October 25, 2025, granting provisional protection to an investor seeking to prevent the platform from redistributing his 3,532 XRP tokens, valued at approximately $9,400, as part of a controversial “loss socialization” scheme following the hack of $230 million on the platform in July 2024.

A Precedent Victory for User Rights

The case centered on Rhutikumari, who bought her XRP tokens in January 2024 for approximately 198,516 rupees (about $2,400). After the platform froze all user accounts following the massive breach, the investor argued that her assets were fundamentally different from the stolen Ethereum-based tokens and should not be subject to a loss redistribution across the platform.

“What the applicant held as cryptocurrencies were 3532.30 XRP coins. What was the subject of the cyberattack on 18.7.2024 on the platform were ERC 20 coins, which are completely different cryptocurrencies not held by the applicant,” the court noted.

The ruling establishes that cryptocurrency assets possess “all the essential characteristics of property” despite being intangible and not recognized as legal tender. This classification means that digital assets can be owned, enjoyed, and held in trust, a significant development for the evolving cryptocurrency jurisprudence in India.

Understanding the Controversial Recovery Plan of the Platform

After the cyberattack on July 18, 2024, the platform proposed a restructuring scheme that would spread the losses proportionally among all users, regardless of whether their specific assets were affected by the breach. According to this “loss socialization” approach, even users holding cryptocurrencies unrelated to the stolen ERC-20 tokens would absorb a portion of the platform's operational failures.

The parent company of the exchange, based in Singapore, secured the approval of 95.7% of the participating creditors for the restructuring plan through the Singapore High Court. However, the decision of the Madras High Court demonstrates that Indian users can still seek domestic legal protection even when the company's legal headquarters are located abroad.

Judge Venkatesh firmly rejected the notion that unaffected users' assets could be frozen to offset losses on the platform, calling the idea of “socializing” losses “unreasonable and not contractually supported.”

The Hacking of $230 Million that Shook India's Crypto Market

The security breach that triggered this legal battle occurred on July 18, 2024, when hackers exploited a vulnerability in the multi-signature wallet system of the platform, draining approximately $234.9 million in digital assets. The attack targeted wallets managed by the custody provider Liminal, with the platform attributing responsibility to the custodian, a claim that Liminal contested.

The United States, Japan, and South Korea later confirmed in a joint statement that the notorious Lazarus Group from North Korea orchestrated the attack. The statement emphasized that “the cyber program of the Democratic People's Republic of Korea poses a threat to our three countries and to the international community in general, and in particular represents a significant threat to the integrity and stability of the international financial system.”

The Lazarus Group, linked to North Korea's intelligence agency, has a documented history of attacking cryptocurrency platforms to fund the regime's weapons programs. Blockchain researchers identified the characteristics of the attack as consistent with Lazarus operations, highlighting the methodical and sophisticated nature of the breach.

The hack forced the platform to disconnect for 16 months, freezing user withdrawals and generating widespread debate about responsibility and asset security in India's largely unregulated crypto market.

Legal Protections and Guarantee Deposit Requirements

To enforce its ruling, the Madras High Court invoked the Arbitration and Conciliation Act of 1996, ensuring that the user receives comprehensive legal measures until the arbitration proceedings are concluded. The platform must deposit 956,000 rupees (approximately $11,500) in an escrow or provide a bank guarantee for the same amount as provisional protection.

The court held that Indian courts can grant interim protection when it is necessary to safeguard assets located in India, even when the related arbitration is seated abroad.

Since the transactions of the investor originated from Chennai and the funds were transferred from an Indian bank account, part of the cause of action arose within the jurisdiction of the Madras High Court.

Building on the Precedent of the Bombay High Court

The Madras ruling is based on the recent precedent set by the Bombay High Court, which rejected similar loss-sharing measures in a case involving Bitcipher Labs (operating as CoinSwitch) against Zanmai Labs in October 2025.

Judge Somasekhar Sundaresan dismissed the platform's challenge to the orders of the arbitration tribunal, reaffirming the instructions to secure Bitcipher's cryptocurrency assets through bank guarantees and escrow deposits. The Bombay court noted that “the view that Bitcipher must be secured for its claim to its own assets, which were only stored on the platform, cannot be considered perverse or manifestly illegal.”

Together, these decisions establish that cryptocurrency platforms have a fiduciary duty to safeguard users' assets held in trust and cannot unilaterally redistribute holdings to compensate for platform failures.

The platform resumes operations amid legal turbulence.

The decision of the Madras High Court came on the same day that the platform officially resumed operations on October 24, 2025, marking its return after more than a year offline. The platform restarted trading in phases over four days, with all cryptocurrency pairs available by October 27.

“Your support helped us achieve the impossible task of rebooting,” wrote the co-founder of the platform on social media. “Now we have the next step: to create more value for all those affected.”

However, the reopening has been met with mixed reactions. Although deposits in Indian rupees and cryptocurrencies have been restored, users report receiving only 30% of their expected funds amid blocked accounts and delays in customer verification. The platform has implemented fee-free trading for at least 30 days as part of its recovery efforts and has partnered with a U.S. custodian to strengthen asset protection.

Implications for India's Crypto Regulatory Framework

The Madras ruling comes at a critical moment for cryptocurrency regulation in India. Although the government has imposed a strict 30% tax on cryptocurrency transactions, there is a lack of comprehensive legislation regulating investor rights and asset ownership.

The court recognized this regulatory gap, noting that “India has the opportunity to design a regulatory regime that fosters innovation while protecting consumers and maintaining financial stability.” Judge Venkatesh emphasized that “through each ruling, they are forming a clearer picture of rights, responsibilities, and trust in the age of decentralization.”

Legal observers see these recent court decisions as signs that the Indian judiciary is proactively defining protections for users in the absence of comprehensive legislation. The rulings could significantly influence how future disputes are adjudicated as India moves towards establishing a clearer regulatory framework for digital assets.

What Does This Mean for Crypto Users

The recognition of cryptocurrencies as property by the Madras High Court establishes several important principles:

Property Rights: Users retain ownership of their digital assets even when stored on exchange platforms, similar to traditional property rights for stocks, bonds, or real estate.

Custodial Responsibility: Platforms cannot dilute or redistribute users' holdings to compensate for operational failures or security breaches unless explicitly authorized by contract.

Jurisdictional Protection: Indian users can seek domestic legal remedies even when platforms operate under foreign jurisdictions, as long as part of the cause of action arose within India.

Asset Segregation: Different types of cryptocurrencies must be treated as distinct assets. Losses affecting one category cannot be automatically applied to the unaffected tokens held by users.

The ruling reinforces that custodial responsibility extends beyond contractual obligations to fundamental property rights, potentially establishing a powerful legal precedent for the entire South Asian region. The landscape surrounding cryptocurrency ownership in India is increasingly defined through judicial intervention, rather than legislative action.

For thousands of Indian users still waiting to recover their funds from the 2024 hack, the decision from Madras marks the first tangible legal victory. While it does not eliminate the inherent risks of cryptocurrency trading, it establishes a clear framework for accountability and user protection.

The coming months will reveal whether these judicial decisions catalyze comprehensive cryptocurrency regulation in India or if they remain isolated judicial interpretations within an evolving legal framework. What is certain is that Indian courts have firmly established cryptocurrencies as a form of protected property, a development that reinforces investor confidence and compels platforms to be accountable for the protection of digital assets.