CoinDCX has disclosed that 15.99 million USDT, worth roughly $16 million, was lost after deposits accumulated in wallet infrastructure the Indian exchange had described as retired following its July 2025 security incident. The company said the loss was caused by a temporary failure in an automated system that should have swept incoming deposits away from those older addresses, and said it absorbed the loss without affecting customer balances, trading, deposits, or withdrawals.
The admission, made in a blog update published early Sunday, followed several days of conflicting public statements from CoinDCX and blockchain researchers tracking the transfers. CoinDCX initially characterized reports of a breach as a “false alarm” and said the addresses identified in the outflows had not been used since the 2025 attack. It later acknowledged that deposits had continued to reach the deprecated addresses during the period when the sweeping process was not working.
CoinDCX said its user funds were held in segregated cold wallets protected through offline controls and multilayer custody arrangements. The episode nevertheless exposes an operational weakness extending beyond the protection of primary custody wallets: a deposit-address system remained capable of receiving customer assets even after the addresses had been removed from active use.
Funds moved through Tron deposit addresses
The suspicious transfers were first flagged publicly on Wednesday by Darcy, co-founder of asset recovery service FlashRescue. In a post on X, Darcy said approximately 15.99 million USDT and 5,783.81 TRX had moved from CoinDCX’s hot wallet and multiple deposit addresses at 11:35 a.m. ET on Tuesday.
According to Darcy’s onchain review, the funds were consolidated at one Tron address. The largest transfer amounted to 15,819,002 USDT, after which assets were sent onward to deposit addresses associated with Binance, OKX, and Gate.
CoinDCX’s later explanation connected those movements to its old deposit-wallet infrastructure. The company said an automated sweeping service — software designed to transfer deposits from receiving addresses into controlled wallets — failed for an unspecified period. That allowed deposits to remain accessible at addresses the firm considered deprecated.
“An operational issue with the sweeping mechanism for a particular period led to a loss of 15.99 million USDT which was absorbed by the company,” CoinDCX said in its blog post.
The company did not provide a detailed timeline for the sweeping failure, identify the vulnerability involved, or say how long deposits had been accumulating at the affected addresses. It described the infrastructure as having “unknown vulnerabilities.”
Public denial gave way to operational explanation
CoinDCX co-founder and chief executive officer Sumit Gupta initially disputed the reports. Within roughly three hours of Darcy’s post, Gupta wrote that CoinDCX wallets had not been breached and said the addresses in question had already been compromised during the July 2025 incident.
CoinDCX’s official X account followed minutes later, calling reports of a current breach misleading and stating that the cited addresses had not been used since the earlier hack.
ZachXBT, an independent onchain investigator, challenged that account. He wrote that one deposit address had remained in use by a liquidity provider for 10 months after the July 2025 incident. He also said the address swept deposits to CoinDCX’s current hot wallet as recently as April and May 2026, raising questions about whether the wallet infrastructure had been fully retired.
Gupta subsequently said CoinDCX was investigating the issue and that no customer funds would be lost. Later that day, the exchange acknowledged that a sweeping process had failed and that it had taken an operational loss, though it did not disclose the amount until Sunday’s blog update.
The progression from outright rejection to a confirmed $16 million loss places greater weight on CoinDCX’s operational controls and public incident-response process. Blockchain records allowed external observers to identify the consolidation and onward movement of funds before the exchange gave its full explanation, leaving users to reconcile the company’s early assurances with the later disclosure.
ZachXBT later said he had helped freeze stolen crypto worth six figures linked to the incident. CoinDCX’s public relations representative directed questions concerning Gupta’s earlier statements and ZachXBT’s claims to the company blog post.
Second major incident since 2025 hack
The latest loss comes after CoinDCX reported a separate hack of about $44 million in July 2025. Bengaluru police later said attackers had posed as recruiters and persuaded a CoinDCX software engineer to install malware on a company laptop, giving them access to internal systems.
That earlier case centered on compromised internal access. The newly disclosed incident appears to involve a different risk: residual value flowing into deposit addresses that remained technically able to receive funds, combined with a failed process intended to move those assets to a more secure environment.
Deposit addresses are often presented to customers as stable destinations for recurring transfers. When an exchange replaces or retires such addresses, it must either prevent further deposits from arriving or maintain reliable systems to monitor and sweep them. CoinDCX’s account indicates that neither safeguard fully contained this exposure once the automated transfer process stopped operating.
CoinDCX has also faced legal pressure unrelated to the wallet incidents. Indian police arrested Gupta and co-founder Neeraj Khandelwal in March over a fraud complaint, according to the company. CoinDCX said the complaint involved scammers impersonating the exchange through a copycat website.
In October 2025, Coinbase invested in CoinDCX in a transaction that Gupta said valued the exchange at $2.45 billion. The company’s latest disclosure puts renewed scrutiny on whether its post-2025 security remediation extended sufficiently to old deposit pathways, third-party liquidity operations, and automated wallet-management systems.
Worried about exchange hacks? Learn how cold vs hot wallet security works to better protect your crypto.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
