When WazirX was hit by one of India’s largest cryptocurrency hacks in 2024, resulting in the theft of crypto assets worth around USD 230 million from one of its multisignature wallets, thousands of users found themselves asking a question that Indian law has yet to answer convincingly: if a crypto exchange loses customer assets, who is legally responsible? As the platform entered a restructuring process and litigation unfolded across jurisdictions, the episode exposed a gap that extends beyond cybersecurity or blockchain technology.

India has steadily built rules to tax, monitor and scrutinise virtual digital assets (VDAs), but it has not yet developed a comprehensive legal framework defining the rights of investors or the duties owed…