Key points
- CoinDCX, India’s largest crypto exchange by trading volume, said it absorbed a loss of 15.99 million USDT, about $16 million, after an internal process failed to move customer deposits out of a retired wallet.
- CEO Sumit Gupta first called the reports a false alarm, then the exchange confirmed the loss in a blog post on Sunday, October 25.
- The retired address belonged to wallet infrastructure compromised in CoinDCX’s July 19, 2025 breach, and investigator ZachXBT said at least one such address kept sweeping deposits into 2026.
CoinDCX, India’s largest cryptocurrency exchange by trading volume, said it absorbed a loss of 15.99 million USDT, roughly $16 million, after an internal process failed to move customer deposits out of a retired wallet. The Mumbai-based company confirmed the CoinDCX $16 million loss in a blog post published on Sunday, October 25, 2026.
The disclosure followed several days of back and forth. Blockchain investigators flagged about $16 million in suspicious outflows from addresses linked to the exchange around October 21. CoinDCX CEO Sumit Gupta first pushed back on X, calling the reports a false alarm and saying the flagged addresses had been compromised in the exchange’s July 19, 2025 breach and abandoned since.
“This wallet belongs to our old operational wallet infrastructure, which was compromised during the security incident we reported on July 19, 2025, and was deprecated as a result,” CoinDCX said.
Each user receives a personal deposit address, and the exchange said some users kept sending funds to the retired, or deprecated, addresses even after they were taken out of service. CoinDCX said it credited those users the moment deposits reached the old wallet. A secondary service, which the exchange calls sweeping, was then meant to move the funds from the deprecated address into the primary secure CoinDCX wallet.
That sweeping service failed for a period, causing deposits to pool at the retired address instead of moving on. “This led to a loss of 15.99 million USDT which was absorbed by the company,” CoinDCX said. The exchange said all user funds remain in segregated cold wallets and that customer balances were unaffected.
ALSO READ: Bengaluru Leads India’s Ethereum Surge, Tier-2 Cities and Women Lead India’s New Crypto Boom
On-chain investigator ZachXBT disputed how dormant the address really was. He said at least one flagged address, labeled TQKJQ, was in use by a liquidity provider and swept user deposits into CoinDCX’s current public hot wallet as recently as April and May 2026. He criticized the exchange’s initial denial and urged users to withdraw their assets.
CoinDCX acknowledged it could have moved faster, saying it needed time to review the deprecated infrastructure and confirm the sequence of events before disclosing the loss. The blog post does not describe the episode as a hack and does not say who moved the funds.
The loss is the second balance-sheet hit CoinDCX has taken in roughly 15 months. The July 2025 breach drained about $44 million from an internal operational account, which the company also absorbed. Bengaluru police later said attackers posing as recruiters had tricked a CoinDCX software engineer into installing malware on a company laptop. Coinbase invested in CoinDCX in October 2025 in a deal the exchange said valued it at $2.45 billion. A confirmed $16 million loss is unlikely to move broader crypto markets, though it adds to questions in India over exchange wallet controls and how quickly platforms disclose incidents.
Editorial Note: Reported and edited by the Crypto India Magazine editorial team. We use AI tools to assist with research and drafting; every article is reviewed and fact-checked by our editors.
Interested in advertising with CIM? Talk to us!
