Large crypto exchange hacks show that cyber resilience matters more than cyber-impregnability. Discuss with reference to regulatory design for India's VDA ecosystem.

Cyber-impregnability means a platform that can never be breached. Exchanges face attacks every day, so that goal cannot be reached. Cyber resilience means taking a breach, restoring users' assets and carrying on. India's Virtual Digital Asset (VDA) regime should be built around resilience.

Why resilience matters more

• Breaches will happen: Even the largest exchanges get hacked. Binance's recent breach and the 2024 hack of the Indian exchange WazirX show that defence is a constant cat-and-mouse game.
• Recovery decides the outcome: Binance largely made users whole within days. It used SAFU, an emergency fund built in advance from trading fees, and its own money. WazirX had no such fund and proposed to spread the loss across all users. Its users got only partial, delayed recovery through a Singapore court.
• Voluntary safety funds are fragile: Only large, rich firms can insure themselves. Smaller platforms leave users exposed.

Gaps in India's current design

• Taxed but not protected: Gains are taxed at a flat 30%, and losses cannot be set off against other income [1]. There is also 1% TDS under Section 194S [2]. So a user who loses coins in a hack bears the full loss.
• Oversight covers only money laundering: Exchanges report to FIU-IND under the PMLA. Its Section 13 notices to offshore platforms (9, then 25, then 15) target non-registration and AML compliance [3][4][5]. They do not check whether an exchange holds users' coins or has reserves.
• No regulator for exchange safety: No body supervises how exchanges hold users' assets, what reserves they keep, or how they recover from a hack.

Regulatory design built on resilience

• Mandatory reserves: A SAFU-style fund that grows with the user assets an exchange holds, plus public proof of reserves.
• Users' assets kept separate: Client coins kept apart from company funds by law, so losses cannot be spread across all users.
• One supervisor with prudential powers: The IMF prefers full regulation to bans, while still denying crypto legal tender status [6]. This matches the G20 Crypto-asset Roadmap that India pushed in 2023 [7].
• Incident readiness: Compulsory breach reporting and regular recovery drills.
• Activity-based reach: FIU-IND already applies PMLA duties to offshore exchanges based on their activity in India [3]. The same test could require Indian grievance redress for Indian users.

Exchange hacks show that recovery, not perfect defence, protects users. India should add licensing, mandatory reserves and segregation of users' assets to its tax-and-AML approach. This would address the RBI's concerns about monetary sovereignty and still protect investors. That would make the VDA ecosystem resilient, as the G20–IMF roadmap recommends.