Story time: how my friends and I exposed critical CoinDCX vulnerability

One of my friends is a white hat hacker with excellent credentials and keeps poking around on the internet, so does the rest of our gang.

We used to educate new users in TG communities about crypto, scams to avoid and 101 stuff. Have also reported on shady stuff from many exchanges over the years.

One particular instance was when my friend found a vulnerability that allowed him to gain admin control over coindcx exchange (had done it with koinex as well previously, reported to the team ethically).

He reported it to them and got completely ignored. Tried to patch it on their own but didn't do it well enough. They were basically unresponsive.

We were forced to release a podcast with redacted info and basic details on how it was possible. Within 24 hours they reached out to us for a proper fix and agreed to pay him a bounty for his work. That's what it took for them to take their security seriously.

We took down the podcast after it was fixed. But this is a common theme with most Indian startups and organisations. Security always takes a back seat. And this isn't the only company that did this with him.

Anyways, hmu if you need help with infosec, VAPT or cybersecurity in general.