Coming of age

1. At a Glance

• Trigger: A hacker stole $6.3 billion in assets from Binance, the world's largest cryptocurrency exchange. It was the biggest theft in the exchange's history. Binance responded by restoring about 95% of users' assets within four days [1].
• Editorial thesis: The hack does not prove that crypto is unsafe in itself. What India should learn from is how Binance prepared for the attack, through a pre-funded emergency fund (SAFU), and how it recovered afterwards [1].
• UPSC relevance: India taxes crypto (30% tax, 1% TDS) and runs it through its AML (anti-money laundering) framework under the PMLA. It still has no full regulatory law for crypto, and the RBI remains opposed to it [2][4][5][9]. This is a live GS-III issue covering fintech, cybersecurity and investor protection.

2. Why in the News

• The Binance hack: $6.3 billion was stolen. Because that exceeded the SAFU's resources, Binance used its own funds to make users whole. The Hindu editorial "Coming of age" (4 November 2026, page 12) discussed it [1].
• FIU-IND enforcement: India's Financial Intelligence Unit has issued notices under Section 13 of the PMLA, 2002 to offshore crypto service providers (VDA SPs) that did not comply: first 9, then 25, then 15 [6][7][8].
• Legalisation debate: A Member of Parliament, Raghav Chadha, asked the Centre to legalise virtual digital assets (VDAs) in 2026 [10]. The RBI told a parliamentary committee that crypto should not be legalised [5].

3. Background & Evolution

• 2018: Binance set up the Secure Asset Fund for Users (SAFU). It protects user assets after security breaches or platform-level incidents and is funded from trading fees [1].
• Finance Act 2022: India created the legal category of "Virtual Digital Asset" (VDA). It imposed a flat 30% tax on gains plus surcharge and cess, and a 1% TDS under Section 194S [2][3].
• March 2023: Crypto service providers were brought under the AML-CFT framework of the PMLA (anti-money laundering and countering the financing of terrorism). They must register with FIU-IND as reporting entities [4].
• FIU-IND notices: 9 offshore providers received show-cause notices [7]. Later rounds went to 25 offshore providers [6] and then 15 providers [8].
• December 2024: The Finance Ministry told Parliament that ₹824 crore of GST evasion by crypto exchanges had been detected [11].
• 2026: The Income Tax Department updated its guidance note on VDA taxation [2]. The legalisation debate continued in Parliament [10][5].

4. Core Static Facts

Item	Fact
Legal term in India	Virtual Digital Asset (VDA). The law does not call it "cryptocurrency" [2]
Tax rate on transfer income	Flat 30% plus surcharge and cess. Only the cost of acquisition can be deducted [2]
Loss treatment	Losses cannot be set off against any other income and cannot be carried forward [2]
TDS	1% under Section 194S on payments to residents. Payments to non-residents fall under Section 195 [3]
TDS threshold (official)	No TDS if the yearly total is ≤ ₹10,000, or ≤ ₹50,000 when the payer is a "specified person" [3]
AML law	PMLA, 2002. Crypto service providers became reporting entities in March 2023 [4]
AML regulator	FIU-IND, under the Department of Revenue, Ministry of Finance [6]
Enforcement provision	Section 13, PMLA (FIU-IND's power to act against non-compliance) [6][8]
Jurisdiction test	Obligations depend on the activity, not on whether the entity is physically present in India [4]
Central bank stance	The RBI opposes legalisation [5]
SAFU	Set up in 2018 and funded by trading fees [1]
The hack	$6.3 billion stolen; about 95% restored within 4 days [1]

5. Multi-Dimensional Analysis

• Economic
• SAFU is a model of self-insurance: a steady revenue stream (trading fees) funds a reserve for emergencies [1].
• Some commentators argue the 1% TDS pushed high-frequency traders to offshore exchanges, which shrinks India's tax base and its view of the market [4].

• The ₹824 crore of detected GST evasion shows the sector's tax compliance is weak [11].

• Security / Technological

• Hacking now happens daily across all sectors. Even small pharmaceutical firms fend off millions of attacks a month. Defence is a constant cat-and-mouse game in which some breaches will always get through [1].

• So regulators should focus on resilience: reserves, incident response and restoring user funds. Assuming attacks can be completely prevented is unrealistic [1].

• Legal / Regulatory

• India has a dual approach. It taxes crypto and polices it under the PMLA, but it has no statute that licenses exchanges or protects investors [4][5].

• Because FIU-IND's reach depends on activity, it can enforce the law against offshore exchanges [4][6].

• Governance / Investor Protection

• FIU registration covers only AML. It does not regulate crypto as an investment asset and gives users no protection if an exchange fails [4].

• Policy lesson: India could require exchanges to keep SAFU-style mandatory reserves or proof of reserves, as part of any future framework [1].

• Monetary / Financial Stability

• The RBI worries about monetary sovereignty and capital flows, and about stablecoins. This is why it resists legalisation even though the state taxes crypto [5].

6. Recent Developments (last 12–18 months)

• 2026: Binance suffered a $6.3 billion hack. It restored about 95% of user assets within 4 days by drawing on SAFU and its own reserves [1].
• 2026: The Income Tax Department issued an updated guidance note on VDA taxation [2].
• February 2026: Raghav Chadha urged the Centre to legalise VDAs [10].
• 2026: Coverage reported that India taxes crypto while the RBI still wants to keep its distance. The RBI's position before the parliamentary committee was against legalisation [5].
• FIU-IND: Issued Section 13 PMLA notices to 25 offshore crypto service providers [6], and later to 15 more [8].

7. Prelims Hooks

• Indian law uses the term "Virtual Digital Asset", not "cryptocurrency" [2].
• Income from transferring VDAs is taxed at a flat 30%. Only the cost of acquisition is deductible [2].
• VDA losses cannot be set off against other income or carried forward [2].
• TDS on VDA transfers: 1% under Section 194S of the Income Tax Act [3].
• Payments to non-resident VDA sellers fall under Section 195, not Section 194S [3].
• The official TDS threshold is ₹10,000, or ₹50,000 when the payer is a specified person [3].
• Crypto service providers came under the PMLA, 2002 in March 2023 [4].
• Crypto service providers register with FIU-IND as reporting entities. They do not register with SEBI or the RBI [4].
• FIU-IND acts against non-compliant providers under Section 13 of the PMLA [6].
• PMLA obligations apply to offshore exchanges that serve Indian users, even without a physical presence in India [4].
• SAFU stands for Secure Asset Fund for Users. Binance created it in 2018 [1].
• SAFU is funded from trading fees [1].
• ₹824 crore of GST evasion by crypto exchanges was reported to Parliament in December 2024 [11].

8. What Happened When an Indian Exchange Was Hacked

• India has already seen what a hack does without a safety fund
• In July 2024, WazirX, an Indian exchange, lost about $230 million. That was close to half of all the assets on the platform [12][13].
• The attack hit a multi-signature wallet. This is a wallet that needs several people to approve before money can move out of it [13].

• WazirX had no pre-funded reserve like SAFU. So it proposed to socialise the losses, which means spreading the loss across every user. Users would get back only 55% of their holdings. The other 45% would be locked in tokens [12][13].

• Users had to go to a foreign court

• The parent company was based in Singapore. A Singapore court, not an Indian one, gave WazirX a four-month moratorium, a legal pause that protects a company from claims while it plans repayment [12].

• The repayment scheme was later rejected, and users had to vote again on an amended scheme [17].

• Why this matters for the Binance story

• Binance restored about 95% of user assets in 4 days [1]. WazirX users were still voting on a repayment plan a year later [17].

• The difference was the exchange's own preparation. It was not Indian law, because Indian law requires no reserve at all [4].

• It was not a one-off

• In July 2025, CoinDCX, another Indian exchange, lost $44 million in a cyberattack [14].

9. Why Binance's Rescue Is Harder to Copy Than It Looks

• The strongest objection: Binance's recovery proves the market can protect itself, so India does not need new rules
• Binance built SAFU on its own in 2018, with no law telling it to [1].

• It made users whole within days, faster than most court-led recoveries [1].

• What this objection gets right

• Self-insurance from trading fees does work, and it worked at very large scale [1].

• Regulators cannot stop every hack. Planning for recovery is more realistic than promising perfect security [1].

• Where the objection fails

• SAFU was not enough on its own. The $6.3 billion loss was larger than the fund, and Binance paid the rest from its own money [1]. A smaller exchange with a smaller balance sheet could not do that.
• The fund was voluntary. WazirX had no such fund, and its users lost 45% of their holdings for a long time [12].

• Big players can walk away from responsibility. After the WazirX hack, Binance said it had never owned, controlled or run WazirX, even though WazirX's user agreement listed Binance services [15]. A voluntary promise holds only as long as the company chooses to keep it.

• The honest conclusion

• SAFU shows the right design: a reserve, funded in advance, used fast.
• But only a legal rule can make every exchange do it, not just the largest and richest one.

10. Indian Users Pay the Tax but Get No Protection Back

• The state takes a share of gains but gives no safety net for losses
• India takes 30% of VDA gains, and losses cannot be set off against other income [2].
• Yet when WazirX was hacked, no Indian regulator had the power to order the exchange to repay users. A legal expert noted that no regulatory body had taken charge of regulating crypto [13].

• Users were pointed to consumer protection law as one possible route. That law was made for faulty goods and services, not for lost digital assets [13].

• FIU registration solves a different problem

• FIU-IND checks whether an exchange reports suspicious money flows (AML) [4].

• It does not check whether the exchange actually holds the users' coins, or whether it has money set aside for a hack. WazirX itself turned to FIU-IND and the US FBI to trace stolen funds, not to recover them for users [16].

• The loss rule makes a hack hit harder

• A user who loses coins in a hack cannot set that loss against other income [2].
• So the user bears the full loss, while the state kept its share of earlier gains.

11. What Global Bodies Advise Instead of a Ban

• The IMF says bans are costly and easy to get around
• The IMF's 2023 paper Elements of Effective Policies for Crypto Assets says bans are costly to enforce and give people more reason to find ways around them [18].

• It prefers a comprehensive regulatory framework: rules on how much capital and reserves firms must hold, how they treat customers, and who supervises them [18].

• The IMF agrees with part of the RBI's concern

• The same paper says crypto should not get official currency or legal tender status (money that everyone must legally accept), to protect monetary sovereignty (a country's control over its own money) [18].

• So the RBI's worry is valid. But the IMF answer is to regulate firms tightly, not to stay away from the sector.

• India helped write this roadmap

• The G20 Crypto-asset Policy Implementation Roadmap is tracked jointly by the IMF and the FSB (Financial Stability Board) [19].

• India pushed this roadmap during its 2023 G20 presidency. But it still has no domestic law putting the roadmap's licensing and reserve rules into practice [4][5].

• Staying away has a cost India already sees

• The 1% TDS has been linked to traders moving to offshore exchanges [4].
• FIU-IND has had to send notice after notice to offshore platforms: 9, then 25, then 15 [6][7][8]. That pattern fits the IMF warning about people finding ways around strict curbs.

12. Who Should Make Exchanges Keep a Safety Fund

• Parliament / Finance Ministry: name one regulator for exchange safety
• Today FIU-IND covers AML and the tax department covers tax. No body checks whether an exchange can survive a hack [4][13].

• The IMF framework asks for one supervisor with clear powers over crypto firms [18].

• That regulator should require a SAFU-style reserve by law

• The fund should be filled in advance from trading fees, as Binance did [1].
• Its size should grow with the user assets the exchange holds. Binance's loss went beyond its fund [1], so a fixed amount is not enough.

• Proof of reserves (public, checkable proof that the exchange really holds users' coins) would let users see the fund exists.

• Users' coins should be legally kept apart from the company's own money

• WazirX spread the loss over all users, including those whose coins were never in the hacked wallet [12].

• If users' coins are legally separate, they cannot be used to cover the company's losses.

• Indian users need an Indian forum

• WazirX users had to deal with a Singapore court [12].
• FIU-IND already applies Indian law to offshore exchanges based on their activity in India [4]. The same activity test could require any exchange serving Indians to accept Indian dispute resolution.

13. Anchors for Answers

• Data: Binance hack of $6.3 billion; about 95% of user assets restored within 4 days using SAFU plus Binance's own funds [1]
• Data: WazirX hack of about $230 million (July 2024), close to half its platform assets; users offered 55% back, 45% locked [12]
• Data: CoinDCX lost $44 million in a cyberattack (July 2025) [14]
• Data: ₹824 crore of GST evasion by crypto exchanges detected (December 2024) [11]
• Report/Committee: IMF, Elements of Effective Policies for Crypto Assets (2023): prefers regulation to bans; no legal tender status for crypto [18]
• Report/Committee: IMF–FSB G20 Crypto-asset Policy Implementation Roadmap, Status Report (October 2024) [19]
• Law/Case: PMLA, 2002, Section 13 (FIU-IND action against offshore VDA SPs) [6]; Income Tax Act, Section 194S (1% TDS) [3]
• Comparison: WazirX (Singapore court moratorium, losses spread over users) vs Binance (pre-funded SAFU, near-full repayment in 4 days) [1][12]

14. Mains Relevance

• GS-III:
• Indian economy: mobilisation of resources and the financial sector.
• Awareness in IT and computers.

• Challenges to internal security through communication networks; basics of cybersecurity; money laundering and its prevention.

• GS-II: Government policies and interventions; statutory bodies (FIU-IND).

• Possible question stems: 1. "India taxes virtual digital assets but does not regulate them." Critically examine the consequences of this approach for investor protection and financial stability. 2. Large crypto exchange hacks show that cyber resilience matters more than cyber-impregnability. Discuss with reference to regulatory design for India's VDA ecosystem. 3. Evaluate the effectiveness of bringing VDA service providers under the PMLA in curbing money laundering, especially by offshore platforms.

15. Related Topics to Study Next

• RBI's Central Bank Digital Currency (e₹): The state's alternative to private crypto.
• Stablecoins and capital-flow management (FEMA): These drive the RBI's resistance to legalisation.
• PMLA, 2002 and the FATF framework: These form the basis for bringing crypto service providers under AML rules.
• CERT-In cybersecurity directions: Incident reporting rules that apply to crypto platforms.
• Deposit insurance (DICGC): The bank-sector counterpart to SAFU-style user protection.
• G20 / FSB crypto policy roadmap: The global coordination that India championed in 2023.
• Income Tax Act, 2025: Watch for renumbering of the VDA tax provisions.

16. NCERT Concepts to Revise

• Cryptocurrency (Economy): The note's subject: privately issued digital assets that India taxes as VDAs but doesn't recognise as legal tender.
• Prevention of Money Laundering Act 2002 (Polity): Crypto service providers were brought under this law in 2023; FIU-IND uses Section 13 against offshore exchanges.
• Tax deducted at source (Economy): India levies 1% TDS on VDA transfers under Section 194S, a frequently tested Prelims fact.
• Central Bank Digital Currency (Economy): The e₹ is the state's alternative to private crypto, and the RBI backs it while opposing legalisation.
• Financial stability (Economy): The RBI cites financial stability and capital-flow risks as reasons to resist legalising crypto.
• Deposit insurance (Economy): Bank deposit insurance is the closest counterpart to Binance's SAFU fund for protecting users.

17. Common Errors / Trap Areas

• Wrong regulator: Crypto service providers register with FIU-IND under the PMLA, not with SEBI or the RBI [4].
• Taxed does not mean legal tender or regulated: Taxing VDAs does not legalise them or create investor protection. The RBI still opposes legalisation [5].
• TDS threshold: Official guidance says ₹10,000, or ₹50,000 for specified persons. Media reports often say ₹50,000 for everyone [3][4].
• Section mix-up: Section 194S covers TDS on payments to residents. Section 195 covers non-residents [3]. Check whether section numbers change under the new Income Tax Act.
• Misreading the editorial: The hack is not an indictment of crypto. The lesson is about preparedness: SAFU in 2018, funded by fees, plus fast restoration [1].