CoinDCX has confirmed a loss of 15.99 million USDT following an attack on retired deposit wallet infrastructure, reversing earlier public denials by its leadership and revealing failures in its automated fund-sweeping system.
The Indian exchange said in an October 25 statement that it noticed unusual activity on October 21 involving old, deprecated wallet infrastructure that had unknown vulnerabilities. An automated sweeping service, responsible for moving deposited funds from retired addresses into secure operational wallets, had stopped working for a period. That allowed deposits to accumulate at an address customers continued using despite being told to switch to newer wallets. CoinDCX said it absorbed the loss and maintained that customer balances, active wallets, deposits, withdrawals and trading services were unaffected.
The acknowledgment came days after blockchain investigators challenged the exchange's refusal to confirm a breach. On-chain analyst Darcy flagged transfers of approximately 15.99 million USDT and 5,783.81 TRX on Tron on October 21. CoinDCX CEO Sumit Gupta responded that the addresses had been compromised in July 2025 and that reports sounded like a false alarm. ZachXBT pushed back, saying a liquidity provider had used a flagged deposit address for roughly 10 months after the July 2025 incident and that user deposits were being swept to CoinDCX's current hot wallet as recently as April and May 2026.
Bitquery's investigation identified 40 affected addresses and found that 88 deposits totaling about 15.82 million USDT had accumulated in one wallet. It traced roughly $9.63 million through intermediary wallets to deposit addresses linked to Binance, OKX and Gate within 18 hours of the main transfer. Tether subsequently froze approximately $2.21 million across nine wallets on October 22. CoinDCX has not disclosed any asset recovery or identified the recipients of the missing funds.
The latest loss adds to a July 2025 security breach that cost CoinDCX about $44 million. Bengaluru police later said hackers posing as recruiters tricked a CoinDCX software engineer into installing malware on a company laptop, giving attackers access to internal systems. CoinDCX is registered with India's Financial Intelligence Unit, but its disclosure did not say whether it had notified FIU-India, CERT-In or other authorities. The exchange said it plans to strengthen monitoring of older wallet systems and warned customers to verify current deposit addresses before transferring cryptocurrency.
