Crypto

CoinDCX Absorbs 15.99 Million USDT Loss From Retired Wallet Days After CEO Called Reports a 'False Alarm'

Indian exchange CoinDCX said a failed sweeping service let deposits pile up in a wallet compromised in its July 2025 hack, leading to a 15.99 million USDT loss the company absorbed.

Oct 26, 2026 - 07:22

0 1

CoinDCX, which CoinDesk describes as India's largest cryptocurrency exchange by trading volume, has confirmed a loss of 15.99 million USDT, or roughly $16 million, tied to a wallet it stopped using after a 2025 security breach. In a blog post published on Sunday, October 25, 2026, the Mumbai-based exchange said the loss "was absorbed by the company" and that customer balances were unaffected. The disclosure came days after co-founder and Chief Executive Sumit Gupta told users on X that early reports of a breach sounded like "a false alarm," The Block reported.

What CoinDCX says happened

According to the blog post, the affected wallet, identified by the address prefix TQKJQ, was part of CoinDCX's old operational wallet infrastructure, which was compromised during a security incident the exchange reported on July 19, 2025, and was deprecated as a result. CoinDCX said it noticed unusual activity in its systems on October 21, and the next day saw irregular fund movements on the blockchain and in reports from users.

The exchange said some users kept sending deposits to the retired addresses despite guidance to use updated ones. Its system credited those deposits to users' accounts as soon as they arrived, and a separate "sweeping" service was supposed to move the funds into CoinDCX's primary wallet. That service "had failed for a particular period, causing deposits to accumulate in the deprecated address," the company wrote, and the old infrastructure "had unknown vulnerabilities."

"We want to reiterate that all user funds remain safe in secure, segregated cold wallets, protected by multi-layer custody and offline security controls," CoinDCX said, adding that trading, deposits and withdrawals continued without interruption. "We could have been more proactive, but we shared this update as soon as we had the complete picture," it said. The post does not describe the event as a hack or say who moved the funds, CoinDesk noted.

From denial to disclosure

The outflows were first flagged publicly at 1:30 a.m. ET on Wednesday, October 21, by Darcy, co-founder of asset recovery service FlashRescue, who posted that roughly 15.99 million USDT and 5,783.81 TRX left CoinDCX's hot wallet and several deposit addresses at 11:35 a.m. ET on Tuesday, October 20, according to The Block. All of the funds went to a single Tron address; the largest transfer was 15,819,002 USDT, and the funds were then split and routed to deposit addresses at Binance, OKX and Gate.

Less than three hours after Darcy's post, Gupta replied: "Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached." He said the addresses had been compromised in July 2025 and that "the hackers seem to be re-using the old wallet addresses and this sounds like a false alarm." The exchange's official account called the claims "misleading."

On-chain investigator ZachXBT disputed that account, writing that at least one of the addresses "was in use by a [liquidity provider] for 10 months after your July 2025 incident" and had swept user deposits to CoinDCX's current hot wallet as recently as April and May 2026, The Block reported. By 7:47 a.m. ET that Wednesday, CoinDCX had posted that its sweeping process failed "for a particular period" and that this "led to some operational losses, which were absorbed by CoinDCX," without giving a figure, according to The Block. Mint also reported that the company did not disclose the amount lost or how long the process had failed. ZachXBT then advised users to withdraw their funds from the exchange, though he said he had helped freeze stolen crypto worth six figures on CoinDCX's behalf.

Earlier incidents and backers

The July 2025 attack cost CoinDCX about $44 million. Mint reported that the exchange said at the time that an internal operational account used to provide liquidity on a partner exchange was compromised, that customer funds were unaffected and that it would absorb the losses. Bengaluru police later said hackers posing as recruiters had tricked a CoinDCX software engineer into installing malware on a company laptop, according to The Block.

The Block also reported that Indian police arrested Gupta and co-founder Neeraj Khandelwal in March over a fraud complaint that CoinDCX said stemmed from scammers impersonating the exchange through a copycat site. Coinbase invested in CoinDCX in October 2025 in a deal Gupta said valued the exchange at $2.45 billion.

CoinDesk said it had reached out to CoinDCX to ask whether the old, retired addresses were hacked again.

What the exchange plans next

CoinDCX said it will strengthen monitoring and controls around residual systems and remind users that maintaining deprecated deposit addresses is a time-bound activity. It urged customers to verify the latest deposit address in its app or website before every deposit, noting that "exchanges do not typically take liability" for funds sent to deprecated addresses.