CoinDCX Finally Admits $16M Loss From Retired Wallets

Indian cryptocurrency exchange CoinDCX has confirmed a loss of approximately $16 million after initially dismissing reports of suspicious activity as a false alarm. The Mumbai-based platform, one of India’s largest by trading volume, said 15.99 million USDT was taken from old deposit wallets linked to a previous security incident.

The funds moved on the TRON network on October 21, 2026. Blockchain monitors first flagged transfers totalling about 15.99 million USDT along with a smaller amount of TRX from addresses associated with CoinDCX. The largest single transfer involved roughly 15.82 million USDT that later split toward deposit addresses at other exchanges, including Binance, OKX, and Gate.

Initial Denial by CEO Sumit Gupta

Update on the on-chain Wallet Activity – 21st October 2026
Our full update on the recent on-chain activity, what happened, and what it means for you.
User funds remain safe, and trading and withdrawals continue as usual.
Read the full update: https://t.co/fSr10QlkJh

— CoinDCX (@CoinDCX) October 25, 2026

CoinDCX co-founder and CEO Sumit Gupta responded quickly on X. He stated that the addresses in question had been compromised during the exchange’s July 2025 hack, which cost about $44 million, and that the activity appeared to be a false alarm involving reuse of old wallets. Gupta emphasised that current CoinDCX central and user addresses had not sent funds to those older ones and that no new breach had occurred.

Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don’t spread rumours.

The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the previous hack in July 2025. The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm. We have checked all the present CoinDCX central and user addresses. None of them have sent money to these old addresses.

All the CoinDCX addresses are public and can be seen on our POR link. None of these have sent funds to the above addresses in question and none of the CoinDCX funds got compromised.

Will keep you posted if any new info comes to us as the team is investigating it further. More details to follow from the official CoinDCX handles soon.

— Sumit Gupta (@smtgpt) October 22, 2026

The exchange’s official account issued a similar message, describing circulating claims as misleading and noting that the addresses, created in January 2025, had not been used by CoinDCX since the earlier incident. The company stressed that user funds remained safe and that trading continued normally.

On-Chain Investigators Challenge the Account

Prominent on-chain analyst ZachXBT and others disputed the retired-wallet explanation. ZachXBT pointed to a specific deposit address beginning with TQKJQ that a liquidity provider had continued using for roughly 10 months after the July 2025 event.

Withdraw all funds from CoinDCX if you value your assets.

Its co-founders are clowns running a circus.

They publicly and privately denied a theft of its assets occurred meaning they straight up lied or are negligently incompetent.

Later they disclosed the $16M theft and wasted everyone’s time instead of being transparent with the public initially.

Not the first time CoinDCX has done it.

Indian CEXs like CoinDCX, WazirX, BitBNS are all the same.

(I still helped freeze 6 figures for CoinDCX)

— ZachXBT (@zachxbt) October 22, 2026

That address had swept user deposits into CoinDCX’s current public hot wallet as recently as April and May 2026 and received gas fees, according to the analysis. Investigators argued this indicated roughly $15.8 million in deposits may have gone unaccounted for.

Darcy of FlashRescue was among the first to publicly highlight the outflows. These challenges prompted further statements from the exchange.

CoinDCX Confirms Operational Failure and Absorbs Loss

In a subsequent update and blog post, CoinDCX acknowledged the impact on its old, deprecated wallet infrastructure. The exchange explained that some users continued depositing crypto to the compromised addresses despite earlier warnings. An automated sweeping service designed to move those deposits into secure managed wallets failed for a period. As a result, funds accumulated in the vulnerable addresses and were drained.

CoinDCX said it absorbed the loss of 15.99 million USDT. Affected deposits were credited to user accounts. The firm said active wallets, trading systems, and customer assets held in segregated cold wallets were not impacted. It noted the old infrastructure carried unknown vulnerabilities stemming from the prior compromise.

The July 2025 incident involved an internal operational wallet and was later linked by authorities in part to social engineering of an employee. Combined losses from the two episodes approach $60 million.

CoinDCX has repeatedly assured customers that their balances are safe and that the company is covering the operational losses. ZachXBT has publicly advised users to consider withdrawing funds amid questions about the handling of legacy addresses and disclosure timing.

The confirmation, coming days after the initial denial, has gained attention across the industry to wallet lifecycle management and the importance of transparent communication during on-chain alerts amid major hacks, such as BitMart.

The episode highlights ongoing challenges for crypto exchanges in fully decommissioning compromised infrastructure and ensuring automated processes remain reliable. CoinDCX said it is reviewing its systems and will provide further updates as needed. Users are advised to use only the deposit addresses currently listed by the exchange.