India taxes crypto but has not legislated on its legal status. With reference to the recent Binance hack, examine the risks this gap creates for retail investors.

India treats crypto as a Virtual Digital Asset (VDA) for tax and anti-money-laundering (AML) purposes. However, no law defines what investors own or what exchanges owe them. The October 2026 Binance hack cost about $6.3 billion, and only about $3 billion was frozen [1]. It shows how this gap leaves retail investors carrying the risk.

The gap: taxed and policed, but not defined

• Crypto gains are taxed at a flat 30% under Section 115BBH, and only the cost of acquisition can be deducted [2]. A 1% TDS applies under Section 194S [3].
• VDA service providers are PMLA reporting entities supervised by FIU-IND, and these duties cover offshore platforms too [4].
• Neither framework sets custody standards, requires exchanges to keep client assets separate, or provides compensation after a hack.

Risks exposed for retail investors

• Custodial risk: coins held on an exchange are only a claim against that company. Binance paused deposits and withdrawals whatever the market price [1].
• Recovery depends on private firms: Tether froze over 1.567 billion USDT and Circle over 800 million USDC [1]. No Indian regulator ordered this. The two issuers hold about 85% of the stablecoin market [5], and coins without a central issuer cannot be frozen.
• No Indian route to redress: India has no law on who is repaid first when an exchange fails. Users of an offshore platform must rely on foreign proceedings, as WazirX users did in a Singapore court after the 2024 hack.
• Unequal tax treatment: VDA losses cannot be set off against other income [2]. The state taxes gains but shares none of the losses caused by a hack.
• Offshore exposure: FIU-IND has issued notices to offshore platforms found operating illegally in India [4]. Users of these platforms get even weaker protection.
• Wider risks: the RBI warns that stablecoins can lose their dollar peg (de-pegging) and that dollar tokens could replace the rupee (digital dollarisation) [5].

Way forward

• Pass a law on VDA status that sets out users' property rights, separation of client assets and repayment priority if an exchange fails.
• Link FIU-IND registration to cybersecurity standards and require a local entity that can repay Indian users.
• Study the EU's MiCA and the US GENIUS Act, which the RBI notes as steps towards clearer regulation [6], while keeping stablecoins out of everyday payments.

India's tax-only approach brings the state revenue while investors carry the risk, as the Binance hack shows. A focused law that protects investors' holdings on exchanges, without treating stablecoins as money, would ease the RBI's stability concerns. It would also give crypto users protection like that of SEBI-regulated markets.