CoinDCX said on Oct. 25 that it lost 15.99 million USDT after legacy wallet infrastructure was accessed without authorization and an automated wallet-sweeping system stopped working as intended, leaving funds stranded in outdated addresses.
The Indian crypto exchange said the loss, roughly $16 million, will be covered by the company. It also said its current trading and wallet systems were not affected, and that user deposits, withdrawals, and trading services continue to operate normally.
The disclosure followed an earlier public denial from CoinDCX co-founder and CEO Sumit Gupta. On Oct. 22, Gupta said on-chain alerts about a roughly $16 million theft may have been a 「False Alarm」. On Oct. 25, the exchange formally acknowledged that its old wallet system had in fact been exploited.
Old addresses kept receiving user funds
According to CoinDCX’s Oct. 25 statement, the incident dates back to Oct. 21. The exchange said the affected addresses belonged to a legacy wallet system that had been retired after a July 2025 hack, but some users continued sending funds to those outdated addresses.
Under normal operations, CoinDCX said it would first credit user deposits and then move the funds into secure wallets through an automated wallet-sweeping service. That mechanism stopped functioning properly for a period of time, allowing large amounts of USDT to build up in the old addresses before the funds were moved out.
Gupta denied a new hack before ZachXBT challenged the explanation
The incident was first flagged by on-chain investigator Darcy, who said CoinDCX-linked TRON wallets showed an abnormal transfer of about 15.99 million USDT. Gupta then responded that the current wallet system had not been compromised and said the transactions may have involved hackers reusing old addresses that had already been breached last year.
He described the situation as looking like a false alarm. ZachXBT later disputed that account, pointing to transaction records showing that one of the addresses involved was still being used by a liquidity provider after the July 2025 security incident and had sent funds to CoinDCX’s current hot wallet in April and May 2026.
Based on those records, ZachXBT questioned CoinDCX’s claim that the old wallet had already been retired. CoinDCX later said the investigation into the legacy infrastructure took time and acknowledged that it could have communicated more proactively.
Bitquery traced transfers across about 40 TRON addresses
Bitquery said the attacker moved funds from about 40 CoinDCX-linked TRON addresses. One address alone accounted for about 15.82 million USDT, or nearly 99% of the total loss.
The firm said the attacker split the funds and, within about a day of the incident, sent around 9.63 million USDT to deposit addresses at three exchanges:
- OKX: about 5.46 million USDT
- Binance: about 2.77 million USDT
- Gate: about 1.39 million USDT
Bitquery also said Tether froze nine related addresses on Oct. 22, covering about 2.21 million USDT. It added that transfers into exchange deposit addresses do not by themselves confirm the funds were cashed out, and the final destination of all stolen assets remains unclear.
Second major security incident in about 15 months
CoinDCX had already suffered a security incident worth about $44 million in July 2025. Roughly 15 months later, the exchange is again facing a major loss tied to legacy wallets and internal fund-handling processes.
CoinDCX said customer account balances and segregated cold-wallet assets were not affected. The identity of the attacker, the exact intrusion method, and the reason its internal risk controls failed to stop funds from accumulating in the old addresses remain under investigation.
