“Recovering stolen crypto is hard as a lot of them are converted to other tokens, and since crypto is dealt with internationally, it can go to any exchange in any country. The silver lining is that transactions can be tracked and in a few past cases it has been recovered too,” said Ashish Singhal, co-founder, CoinSwitch; a crypto exchange platform.

He elucidated that the recovery of funds following a cyberattack of this scale is a tedious process as the stolen quantum can remain in a wallet for many years at a stretch.

Meanwhile, in the backdrop of a lack of a regulatory environment for crypto in India, it becomes a challenge to terminate transactions that involve stolen tokens.

“Although it is trackable, you still cannot stop its usage everywhere. That becomes the real problem as there will always be a decentralised platform where these tokens can be converted from one to another, or one wallet to another,” said Edul Patel, CEO, Mudrex, a crypto platform.

Legal experts tracking the sector believe that users who have lost their funds can look at the country’s consumer protection laws as one recourse.

“In terms of consumers, there is no specific law which you can go to and refer to in this instant cyberattack. But in any case, consumer laws would be applicable if there is any negligence found on the part of WazirX, claiming that there was a deficiency in their services, further depending on the remedies sought by the customers relief under Information Technology Act, 2002 or Arbitration and Conciliation Act, 1996” said Navodaya Singh Rajpurohit, Legal Partner, Coinque Consulting and founder, Pravadati Legal.

On Sunday, WazirX announced a bounty program to track and freeze the stolen amount.

The company has promised that it will reward those assisting in recovery with a bounty pegged at 5 per cent of the recovered amount as part of the program.

The company did not respond to queries sent by Business Standard till press time.

Meanwhile, with the Union Budget around the corner, calls for better regulatory clarity for the sector have grown stronger.

“What should now come out of this is that there should be conversations around active regulations, making self-custody a real possibility for people, allowing decentralised exchanges to conduct transactions, which is one of the ways to secure a user’s money,” Patel from Mudrex said.

Home-grown cryptocurrency firms had earlier suggested that regulating the sector may necessitate the involvement of multiple agencies, given the approaching deadline to develop a unified framework, Business Standard reported this month.

Industry participants said that creating comprehensive legislation through a single regulator could be complex and time-intensive ahead of the 2025 timeline.

“This incident could potentially prompt regulatory changes in India. To date, no regulatory body has taken the initiative to regulate crypto in the country. While the Financial Intelligence Unit (FIU) exists, its primary mandate is the prevention of money laundering, not addressing cyber attacks, which may limit its jurisdiction in this matter, unless it is found in the investigation that the money has been laundered through this cyberatack,” legal expert Rajpurohit said.