CoinDCX admits losing $16 million days after calling hack reports a false alarm
Indian crypto exchange CoinDCX has admitted losing 15.99 million USDT, about $16 million, from deposit wallets it had stopped using. The admission came on 25 October in a blog post, three days after its chief executive called reports of the theft a "false alarm".
The exchange says it is covering the loss itself and that customer balances in cold wallets were not touched. The episode still matters to anyone who keeps coins on an exchange: the first public reaction was a denial, and the money came from an address that customers were still sending deposits to.
From denial to admission
On 22 October blockchain investigator Darcy, co-founder of FlashRescue, flagged about 15.99 million USDT and 5,783.81 TRX leaving wallets linked to CoinDCX on the Tron network. Less than three hours later CEO Sumit Gupta replied on X that the report was incorrect: the addresses had been compromised back in July 2025, no funds had moved from current wallets, and the alert sounded like a "false alarm". The exchange's own account called the claims "misleading".
On-chain investigator ZachXBT disputed the idea that the wallets were retired. He said one of the deposit addresses had been used by a liquidity provider for about ten months after the July hack and had swept user deposits to CoinDCX's current hot wallet as recently as April and May 2026. He advised users to withdraw their funds from the exchange.
In the 25 October post, CoinDCX said it had detected unusual activity on 21 October that "had impacted our old, deprecated wallet infrastructure which had unknown vulnerabilities". Its automated sweeping service, which moves money out of deposit addresses, had failed for a period, so deposits piled up at an address the exchange no longer used. "This led to a loss of 15.99 million USDT which was absorbed by the company," the post says.
Where the CoinDCX money went
According to an analysis by Bitquery cited by crypto.news, 88 deposits totalling about 15.82 million USDT had built up in a single wallet. Within 18 hours, roughly $9.63 million passed through intermediary wallets to deposit addresses linked to OKX, Binance and Gate. Tether froze about $2.21 million across nine wallets on 22 October.
CoinDCX has not said how the attacker got the private keys, when the sweeping service stopped working or whether any money has been recovered. Its statement also does not say whether Indian authorities, such as the Financial Intelligence Unit or CERT-In, were notified. A company representative referred journalists to the blog post and did not answer follow-up questions, The Block reported.
The second loss in 15 months
In July 2025 the same exchange lost about $44 million. Bengaluru police later said hackers posing as recruiters had tricked a CoinDCX engineer into installing malware that opened access to internal systems. The wallets drained this month are the ones the exchange says it retired after that breach.
For customers, the practical lesson is in the mechanism. Some kept sending money to the old address after the exchange had told them to switch. Before every transfer, copy the deposit address from the exchange's app or site at that moment, rather than from your transaction history or an old saved contact. Coins left on any exchange depend on how it runs its wallets, so savings you are not trading are safer in a wallet whose keys you hold yourself. Trading, deposits and withdrawals on CoinDCX continued throughout, and the exchange says it will tighten monitoring of its older wallet systems.
