TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
CoinDCX says it absorbed a $15.99 million loss after a service failed to move deposits from a retired wallet linked to its 2025 security breach. The exchange says customer balances, active wallets and trading systems were unaffected, but has not explained who moved the funds or how.
CoinDCX, which CoinDesk describes as India’s largest crypto exchange by trading volume, says it absorbed a $15.99 million loss after an internal service failed to move deposits from a retired wallet. The exchange said some users continued sending funds to addresses deprecated after a July 2025 security breach, and that a process intended to transfer those deposits to its main wallet failed for a period.
CoinDCX said users’ deposits were credited to their portfolios when they arrived at the old address. A separate process, called sweeping by the exchange, was supposed to transfer the funds from the deprecated wallet to its primary wallet. CoinDCX said that service did not work for a particular period, leaving deposits to accumulate in the old address. The company said it absorbed the resulting 15.99 million USDT loss.
The disclosure followed reports last week of about $16 million in suspicious outflows from wallets associated with the exchange. CoinDCX initially dismissed those reports. CEO Sumit Gupta called them a false alarm on X, while a company spokesperson told CoinDesk that the addresses were old, had been compromised in the 2025 incident and were no longer in use.
On-chain investigator ZachXBT disputed the suggestion that the addresses had no continuing connection to the exchange. He said at least one address, identified as TQKJQ, was being used by a liquidity provider and had swept user deposits to CoinDCX’s current public hot wallet in April and May 2026. CoinDCX later acknowledged that the wallet belonged to its old operational infrastructure and linked the loss to it.
A Process Failure With a $16M Cost
The disclosure shows that retiring a wallet address did not, by itself, stop deposits from reaching it. CoinDCX’s own explanation says the exchange continued crediting users when funds arrived, while relying on a separate transfer service to move those funds into its primary wallet. When that service failed, deposits remained in infrastructure the company said had been compromised in the past.
For customers, the immediate distinction is between the exchange’s reported corporate loss and the status of user account balances. CoinDCX said customer balances, active wallets and trading systems were unaffected, and that it absorbed the loss rather than passing it on to users. The disclosure nevertheless raises questions about how deposits to retired addresses are detected and protected, and how quickly users are warned not to use them.
The episode also puts attention on the exchange’s response to the initial outflow reports. CoinDCX first said the activity was unrelated to its operations, then published a fuller explanation after reviewing its deprecated infrastructure. That sequence matters to customers and market observers trying to understand what the exchange knew at each stage and how it verified the source and destination of the funds.
Products Worth Considering
Trezor Safe 5 Crypto Hardware Wallet with Color Touchscreen, Black Graphite
Ledger Nano X Bluetooth Crypto Wallet
Trezor Safe 7 Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
The 2025 Breach and Old Wallets
CoinDCX said the wallet involved belonged to an older operational setup and was compromised during a security incident reported on July 19, 2025. The exchange said it deprecated that infrastructure after the breach. CoinDesk’s report puts the cost of the 2025 hack at about $44 million.
The latest incident concerns funds deposited after the wallet was retired, rather than a newly described breach of CoinDCX’s active wallet system. According to the company, users continued sending deposits to old addresses, their portfolios were credited, and the sweeping service was meant to forward the assets. The exchange’s account identifies a failure in that transfer process but does not establish how the funds later left the wallet.
CoinDCX says customer assets are held in segregated cold wallets, which are kept offline, and are protected by multiple custody controls. It characterized those holdings and its active systems as unaffected by the loss tied to the deprecated wallet.
“This wallet belongs to our old operational wallet infrastructure, which was compromised during the security incident we reported on July 19, 2025, and was deprecated as a result.”
— CoinDCX, in its blog post
How the Funds Left the Wallet
CoinDCX’s post does not say who moved the funds, how the irregular outflow occurred or whether the retired addresses were compromised again after the 2025 breach. The company did not describe the event as a new hack in the account cited by CoinDesk. CoinDesk said it had asked CoinDCX whether the old addresses were hacked again; an answer was not included in the report.
The exchange also did not specify the exact period when the sweeping service failed, how many deposits were affected, or what technical or operational change caused the failure. Its statement that users’ balances and active systems were unaffected is the company’s account; the report provides no independent audit or detailed accounting of the loss.
There is also a gap between the exchange’s initial dismissal of the reported outflows and its later explanation that the wallet was part of old operational infrastructure and connected to the loss. The available information does not show when CoinDCX first identified the failed process or what evidence prompted it to revise its earlier characterization.
Further Details From CoinDCX
The next development will depend on whether CoinDCX provides more information about the outflow, the duration of the failed sweeping process and the steps it has taken to prevent further deposits to retired addresses. The company’s published explanation says it completed a review of the deprecated infrastructure, but does not set out a timeline for additional disclosures or describe changes to its deposit controls.
CoinDesk reported that it had contacted CoinDCX with questions about whether the old wallet addresses were compromised again. Any response could clarify whether the loss resulted from unauthorized access, another kind of fund movement or a different cause. Until the exchange provides that detail, the mechanism behind the loss remains unresolved.
For now, CoinDCX says the $15.99 million loss was absorbed by the company and that customer balances, active wallets and trading systems remain unaffected. Those are the confirmed points in its account; the cause of the fund movement and the effectiveness of any subsequent controls have not been detailed in the reported material.
Key Questions
How much did CoinDCX say it lost?
CoinDCX said it absorbed a loss of 15.99 million USDT, described in the report as about $16 million.
What caused the reported loss?
The exchange said a service failed to sweep deposits from a retired wallet into its primary wallet. It has not explained who moved the funds or how the outflow occurred.
Did CoinDCX say customer balances were affected?
No. CoinDCX said customer balances, active wallets and trading systems were unaffected, and that the company absorbed the loss. That statement is the exchange’s account.
Was this confirmed to be a new hack?
The reported blog post does not call the event a new hack or identify who was behind the fund movement. CoinDCX’s explanation ties the wallet to infrastructure compromised in its July 2025 security incident, but whether the old addresses were attacked again remains unclear.
Source: rss
