CoinDCX admits $16 million loss from retired wallets after denial

CoinDCX has admitted losing 15.99 million USDT, about $16 million, to an attack on a wallet system the Indian exchange retired after a 2025 hack. It confirmed the loss on October 25. The company says it covered the shortfall itself.

That figure comes from CoinDCX's own statement, posted on October 25 and quoted the same day by The Block, crypto.news and other outlets. In it, the exchange said the attack hit "old, deprecated wallet infrastructure which had unknown vulnerabilities." An automated service meant to sweep funds out of those retired addresses had failed for a time. Deposits kept arriving. They piled up unseen.

What CoinDCX says went wrong

CoinDCX retired the old wallet system after a breach on July 19, 2025. That earlier incident drained about $44 million, close to three times the latest loss. When the exchange moved to new infrastructure, it kept a service running to sweep any stray deposits out of the dead addresses. Some customers carried on sending money to those old addresses. For a window the company has not dated, the sweeper stopped doing its job.

In its statement, the exchange put the damage at "15.99 million USDT, which was absorbed by the company." Active wallets, trading, deposits and withdrawals all ran normally, it said. Customer money sits in separate cold storage. None of it was lost, according to the firm.

A denial, then an admission

The loss became public before CoinDCX called it a loss. Darcy, of the recovery firm FlashRescue, logged unusual outflows at 11:35 a.m. ET on October 21 and flagged them publicly hours later. On October 22, chief executive Sumit Gupta pushed back on X. "Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached," he wrote. He said the flagged addresses were old ones, compromised back in July 2025, and that attackers appeared to be reusing them.

Gupta went further in the same thread. Replying to on-chain investigator ZachXBT, he said the team was "investigating it further" and that "no user funds will be at loss." CoinDCX itself called the early reports "misleading." Three days later it conceded the money was gone.

ZachXBT disputed the claim that the addresses were dormant. He said one of them kept sweeping user deposits into CoinDCX's main hot wallet as recently as April and May 2026, and put the unaccounted sum at $15.8 million. He told users to "withdraw all funds from CoinDCX if you value your assets," even as he said he had earlier helped the exchange freeze stolen crypto worth six figures. The exchange rejects that reading of the on-chain trail.

CoinDCX conceded its handling could have been better. "We could have been more proactive," the firm said, promising closer monitoring of its retired systems.

It has been a rough year for the exchange. The July 2025 breach cost about $44 million, which Gupta blamed on a server compromise. The Block reported that in March 2026, Indian police arrested Gupta and co-founder Neeraj Khandelwal over a fraud complaint, which the company linked to scammers running a copycat site. This loss lands on top of that record.

What is still unclear

Several basic questions still have no answer. CoinDCX has not said when the sweeping service failed, how long deposits piled up, or how the attacker took control of the funds. It has not given a figure for how much of the money belonged to users rather than the firm. Nor has it said whether it told FIU-India, CERT-In or any other regulator.

Outside analysts have filled in parts of the picture. Blockchain data firm Bitquery counted 88 deposits worth about 15.82 million USDT building up in a single wallet, and traced roughly $9.63 million moving toward accounts at OKX, Binance and Gate, because those transfers sit on public blockchains anyone can follow. Tether froze about $2.21 million across nine addresses on October 22. The rest has not been recovered.

What to watch

The test now is whether CoinDCX fills the gaps it left open. A clear timeline, a split between user and company money, and word on any regulatory notice would answer most of the doubt. So would a full account of why a retired address was still taking in customer deposits more than a year after it was meant to be dead.

For users, the episode is a plain reminder. An exchange, not the customer, holds the keys. CoinDCX bore this loss. A smaller venue might not have.