CoinDCX acknowledges $16 million loss after wallet failure

CoinDCX has confirmed a cryptocurrency loss of nearly $16 million after an internal transfer system failed, reversing its initial dismissal of suspicious withdrawals from wallets previously compromised in a security breach.

The Mumbai-based exchange said on Sunday that it had absorbed the loss of 15.99 million USDT, a dollar-linked cryptocurrency issued by Tether, and that customer balances and active trading systems remained unaffected.

Its disclosure followed questions from blockchain investigators about transfers from addresses associated with CoinDCX. The exchange had initially maintained that the addresses were obsolete and that the alerts did not indicate a fresh compromise of its operating wallets.

CoinDCX said the affected address belonged to infrastructure retired after a July 2025 security incident. Some customers nevertheless continued sending deposits to those addresses rather than the replacement addresses displayed on its platform.

Under its operating procedure, CoinDCX credited customers’ accounts when deposits reached the old wallets. A separate automated service was supposed to transfer, or sweep, the corresponding assets into the exchange’s primary secure wallet.

That service stopped functioning for an unspecified period, allowing deposits to accumulate at an address with unresolved vulnerabilities. CoinDCX said the resulting irregular movements caused the 15.99 million USDT loss, which it covered itself.

The company has not identified who controlled the destination of the missing assets or explained precisely how they were removed. Its statement described an operational failure and vulnerabilities in retired infrastructure, without establishing whether a separate intrusion occurred.

CoinDCX said it first detected unusual activity on 21 October. Its controls and immediate response prevented disruption to active wallets and trading systems, it said. On 22 October, blockchain information and alerts from customers revealed irregular transfers involving the older infrastructure.

The chronology has drawn scrutiny because chief executive and co-founder Sumit Gupta initially rejected suggestions that CoinDCX wallets had been breached. Responding publicly to an alert, he described the suspicious activity as a false alarm linked to addresses compromised in the previous incident.

Blockchain investigator ZachXBT challenged that explanation, pointing to transactions indicating that at least one supposedly retired address had continued processing deposits after July 2025. He identified transfers into the exchange’s current hot wallet during April and May this year.

That evidence raised questions about the distinction between retiring an address for new deposits and continuing to operate recovery processes for funds sent there. CoinDCX subsequently acknowledged that its systems still handled money arriving at deprecated addresses, although it said customers had been instructed to use updated details.

Independent blockchain analysis by Bitquery traced approximately 15.99 million USDT leaving wallets linked to the exchange on 21 October. Its examination identified a particularly large transfer of about 15.82 million USDT from one address, followed by movements through other addresses.

Bitquery also identified transfers reaching deposit addresses associated with Binance, OKX and Gate. Blockchain records can establish transaction paths, but they do not by themselves identify the individuals controlling receiving accounts or determine responsibility for the withdrawals.

The exchange said its customers’ cryptocurrency deposit balances were fully accounted for. It maintained that trading, deposits and withdrawals continued without interruption, and that assets held in segregated cold wallets remained protected by offline custody controls.

Those assurances relate to the company’s accounting and active systems; they do not resolve questions about why a transfer service failed or how funds remained exposed in previously compromised infrastructure. CoinDCX has not published a detailed technical account of the failure or specified its duration.

The company acknowledged shortcomings in the timing of its communication. Its account did not specify when the sweeping service stopped working, when it was restored, or whether additional safeguards had been introduced before the withdrawals. It said a review of the retired infrastructure was needed to establish the sequence of events and conceded that it could have provided information more proactively.

The affected infrastructure had been withdrawn following a July 2025 breach that cost the exchange approximately $44 million. The latest disclosure therefore concerns funds accumulating at addresses associated with an already identified security exposure rather than a newly introduced customer deposit system.

CoinDCX said it would strengthen monitoring and controls around residual infrastructure and remind customers to check deposit addresses before transferring cryptocurrency. It warned that sending assets to deprecated addresses carries substantial risks and that exchanges do not ordinarily accept liability for such transfers.