Key Highlights:
- CoinDCX has confirmed a loss of approximately $16 million after initially dismissing reports of suspicious activity as a false alarm, with 15.99 million USDT taken from old deposit wallets linked to its July 2025 hack.
- CEO Sumit Gupta initially described the activity as a false alarm involving reused wallets, but on-chain analysts, including ZachXBT, challenged that account, pointing to a deposit address still in use months after the earlier incident.
- The exchange later acknowledged that an automated sweeping service had failed, allowing funds to accumulate in vulnerable addresses before being drained.
Indian cryptocurrency exchange CoinDCX has confirmed a loss of approximately $16 million after initially dismissing reports of suspicious activity as a false alarm. The Mumbai-based platform, one of India’s largest by trading volume, said 15.99 million USDT was taken from old deposit wallets linked to a previous security incident.
The funds moved on the TRON network on October 21, 2026. Blockchain monitors first flagged transfers totalling about 15.99 million USDT along with a smaller amount of TRX from addresses associated with CoinDCX. The largest single transfer involved roughly 15.82 million USDT that later split toward deposit addresses at other exchanges, including Binance, OKX, and Gate.
Initial Denial by CEO Sumit Gupta
CoinDCX co-founder and CEO Sumit Gupta responded quickly on X. He stated that the addresses in question had been compromised during the exchange’s July 2025 hack, which cost about $44 million, and that the activity appeared to be a false alarm involving reuse of old wallets. Gupta emphasised that current CoinDCX central and user addresses had not sent funds to those older ones and that no new breach had occurred.
The exchange’s official account issued a similar message, describing circulating claims as misleading and noting that the addresses, created in January 2025, had not been used by CoinDCX since the earlier incident. The company stressed that user funds remained safe and that trading continued normally.
On-Chain Investigators Challenge the Account
Prominent on-chain analyst ZachXBT and others disputed the retired-wallet explanation. ZachXBT pointed to a specific deposit address beginning with TQKJQ that a liquidity provider had continued using for roughly 10 months after the July 2025 event.
That address had swept user deposits into CoinDCX’s current public hot wallet as recently as April and May 2026 and received gas fees, according to the analysis. Investigators argued this indicated roughly $15.8 million in deposits may have gone unaccounted for.
Darcy of FlashRescue was among the first to publicly highlight the outflows. These challenges prompted further statements from the exchange.
CoinDCX Confirms Operational Failure and Absorbs Loss
In a subsequent update and blog post, CoinDCX acknowledged the impact on its old, deprecated wallet infrastructure. The exchange explained that some users continued depositing crypto to the compromised addresses despite earlier warnings. An automated sweeping service designed to move those deposits into secure managed wallets failed for a period. As a result, funds accumulated in the vulnerable addresses and were drained.
CoinDCX said it absorbed the loss of 15.99 million USDT. Affected deposits were credited to user accounts. The firm said active wallets, trading systems, and customer assets held in segregated cold wallets were not impacted. It noted the old infrastructure carried unknown vulnerabilities stemming from the prior compromise.
The July 2025 incident involved an internal operational wallet and was later linked by authorities in part to social engineering of an employee. Combined losses from the two episodes approach $60 million.
CoinDCX has repeatedly assured customers that their balances are safe and that the company is covering the operational losses. ZachXBT has publicly advised users to consider withdrawing funds amid questions about the handling of legacy addresses and disclosure timing.
The confirmation, coming days after the initial denial, has gained attention across the industry to wallet lifecycle management and the importance of transparent communication during on-chain alerts amid major hacks, such as BitMart.
The episode highlights ongoing challenges for crypto exchanges in fully decommissioning compromised infrastructure and ensuring automated processes remain reliable. CoinDCX said it is reviewing its systems and will provide further updates as needed. Users are advised to use only the deposit addresses currently listed by the exchange.
