The CoinDCX wallet loss totaled 15.99 million USDT, approximately $16 million, after an automated service failed to transfer customer deposits out of previously compromised wallet infrastructure, the Indian cryptocurrency exchange said on October 25, 2026.

Key Takeaways

  • Deposits continued to reach old addresses after a July 2025 breach, but the service intended to move the funds to active wallets stopped working.
  • CoinDCX said it absorbed the loss and that customer balances, active wallets and trading systems were unaffected.
  • The exchange has not disclosed when the service failed or how the vulnerability was exploited.

How the CoinDCX wallet loss occurred

CoinDCX said the affected address was part of operational infrastructure retired after a July 19, 2025 security breach. Although customers had been instructed to use updated deposit addresses, some continued sending cryptocurrency to the older wallets.

A recovery mechanism credited those deposits to customer accounts, while a separate automated service was supposed to transfer the underlying funds to active wallets. That sweeping service stopped functioning for an unspecified period, allowing deposits to accumulate in the vulnerable infrastructure.

The exchange said it detected unusual system activity on October 21 and subsequently identified irregular blockchain transfers. It has not said whether the attackers behind the 2025 incident were involved.

Investigators challenged the initial response

Blockchain researchers identified approximately 15.99 million USDT moving from TRON wallets linked to CoinDCX on October 21. Co-founder and chief executive Sumit Gupta initially described the reports as a possible false alarm, saying the addresses were no longer operational.

Investigator ZachXBT pointed to evidence that some addresses had continued processing deposits. Bitquery examined 40 affected wallets and identified approximately $15.82 million accumulated in one address through 88 deposits. It also traced approximately $9.63 million through intermediary wallets to addresses associated with Binance, OKX and Gate.

CoinDCX later acknowledged the failed sweeping process and said its initial public communication could have been more proactive.

Customer operations and earlier breach

CoinDCX said trading, deposits and withdrawals continued without interruption. It advised customers to use current deposit addresses and said additional safeguards were being implemented.

The earlier breach in July 2025 cost approximately $44 million and involved an internal operational account used for liquidity provisioning. The exchange has not established a link between the attackers in that incident and the latest loss.

Read More News

More FinanceVelix news

Disclaimer

This FinanceVelix article provides general information, not personalized financial, investment, legal, or tax advice. Market prices, interest rates and economic conditions can change; investments carry a risk of loss. Facts reflect the material available when published and may change. Check important information independently and consult a qualified professional when needed. Mentioning an asset, company, or service is not an endorsement.