CoinDCX has confirmed losing 15.99 million USDT through compromised wallet infrastructure after initially rejecting claims that nearly $16 million had been stolen from the Indian cryptocurrency exchange.
Summary
- CoinDCX confirmed losing 15.99 million USDT after initially dismissing reports of suspicious wallet transfers.
- A failed automated sweeping service allowed deposits to accumulate in wallets compromised during July 2025.
- Blockchain investigators traced continued activity through supposedly retired wallets, challenging CoinDCX’s initial explanation.
- CoinDCX says it absorbed the losses, leaving customer balances, active wallets, and trading services unaffected.
CoinDCX, in an October 25 statement, acknowledged that an October 21 incident affected its old operational wallets, which it had retired following a $44 million security breach in July 2025.
The exchange said a failure in its automated deposit-sweeping service allowed cryptocurrency to accumulate at an address that customers continued using despite instructions to switch to newer wallets. CoinDCX absorbed the resulting loss and maintained that customer balances and active trading systems were not affected.
CoinDCX reverses its position on the $15.99 million loss
The admission follows several days of disagreement between CoinDCX executives and blockchain investigators over suspicious transactions involving wallets linked to the exchange.
On October 22, CoinDCX CEO Sumit Gupta rejected suggestions of another security breach, saying the flagged addresses belonged to infrastructure compromised in July 2025. He maintained that no funds had moved from current operational wallets into the addresses under scrutiny.
As crypto.news previously reported on October 22, blockchain investigator Darcy had identified transfers involving approximately 15.99 million USDT and 5,783.81 TRX on the Tron network.
Gupta suggested that the previous attackers might have been reusing the compromised addresses, describing the concerns as a possible false alarm.
However, the company’s latest statement confirms that deposits continued arriving at those addresses and that its own systems were responsible for transferring them to secure wallets when the automated service functioned correctly.
CoinDCX said it noticed unusual activity on October 21 but discovered irregular fund movements the following day through blockchain records and community reports.
The company acknowledged that its communication could have been better. “We could have been more proactive,” it said, explaining that the investigation took time to establish the sequence of events.
Why were compromised CoinDCX wallets still processing deposits?
The latest disclosure explains why wallets compromised more than a year ago continued handling customer transactions.
According to CoinDCX, some customers continued sending cryptocurrencies to previously issued deposit addresses even after the exchange replaced its compromised infrastructure.
Instead of abandoning the deposits, the company maintained a recovery process that credited customers immediately when their funds arrived.
A separate automated service then moved the deposited cryptocurrency from the retired addresses into secure operational wallets. CoinDCX said this arrangement allowed users to access their credited balances without waiting for transfers between wallets to finish.
However, the company has not disclosed when the sweeping service stopped working, how long the funds accumulated, or precisely how unauthorized parties gained control of the money.
Blockchain investigator ZachXBT had questioned the claim that the wallets were no longer being used, pointing to an address beginning TQKJQ.
He alleged that a liquidity provider continued using the address for roughly 10 months after the July 2025 breach, with transactions recorded as recently as April and May 2026.
Separate blockchain analysis by Bitquery identified additional activity. Its investigation traced routine deposit movements through affected addresses up to October 21 and found that 88 deposits totaling approximately 15.82 million USDT had accumulated in one wallet.
The findings indicate that the wallet infrastructure continued processing transactions after CoinDCX classified it as retired, although the investigation did not establish how the attacker obtained the private keys.
Blockchain investigators trace funds to other exchanges
The October 21 transfers involved more than one wallet, according to Bitquery’s examination of Tron blockchain records.
Its investigation identified 40 affected addresses and traced approximately $9.63 million through intermediary wallets to deposit addresses associated with OKX, Binance, and Gate within 18 hours of the main transfer.
The analysis found that Tether subsequently froze approximately $2.21 million across nine wallets on October 22. CoinDCX’s official statement did not disclose any asset recovery or identify the recipients of the missing funds.
During the previous July 2025 security breach, CoinDCX attributed the $44 million loss to a sophisticated server compromise affecting an internal liquidity account.
Subsequently, the company restored normal trading operations and said its segregated customer custody arrangements had prevented losses to users.
Will Indian regulators investigate the latest CoinDCX incident?
CoinDCX is registered with India’s Financial Intelligence Unit as a reporting entity subject to anti-money laundering and counterterrorist financing requirements.
However, the exchange’s October 25 disclosure did not mention whether it had notified FIU-India, CERT-In, or another Indian authority about the latest incident.
No confirmed regulatory investigation or enforcement action concerning the October 21 transfers was identified in the reviewed records.
CoinDCX said trading, deposits, and withdrawals continued without restrictions throughout the incident. It plans to strengthen monitoring of older wallet systems and remind customers that support for retired deposit addresses is temporary.
The exchange has advised customers to verify their current deposit addresses before transferring cryptocurrency, warning that sending funds to deprecated wallets carries substantial risk.
