CoinDCX Confirms 15.99M USDT Loss After Denying Hack

CoinDCX, described by Coincentral as India’s largest crypto exchange by trading volume, has confirmed the loss of 15.99 million USDT from wallets it had retired after an earlier breach. The admission, published in an October 25 statement, came days after chief executive Sumit Gupta publicly described reports of suspicious outflows as a false alarm.

According to Coincentral and Crypto.news, the funds left old operational addresses that the Mumbai-based company had replaced following a July 2025 hack that cost it about $44 million. CoinDCX said it will absorb the full amount and that customer balances were not affected.

Key facts

• CoinDCX confirmed a 15.99 million USDT loss in an October 25, 2026 statement and said it would absorb the full amount itself.
• The exchange said it detected unusual activity on October 21 and identified irregular fund movements the following day through blockchain records and community reports.
• Blockchain analytics firm Bitquery found 88 deposits totalling about 15.82 million USDT collected in one wallet and identified 40 affected addresses.
• Bitquery traced roughly $9.63 million through intermediary wallets to deposit addresses associated with OKX, Binance and Gate within 18 hours of the main transfer.
• Tether froze about $2.21 million across nine wallets on October 22, according to Bitquery’s review of Tron network records.

How the wallets kept receiving deposits

CoinDCX’s account is that the addresses formed part of an older operating setup that was shut down after the July 2025 breach. Customers nonetheless continued sending deposits to the retired addresses, and the exchange credited those balances on arrival rather than rejecting them. A separate automated sweeping service was supposed to move the funds into the main CoinDCX wallet; when it failed for a period, deposits accumulated in the retired address.

The company has not said when the sweeping service stopped working, how long funds gathered there, or how outside parties gained control of the money. Its statement did not describe the event as a hack and did not identify who carried out the transfers. CoinDCX acknowledged that its communication could have been more proactive, saying the investigation took time to establish the sequence of events.

Investigators challenged the first explanation

The reversal followed public disagreement between the exchange and on-chain researchers. According to Crypto.news, investigator Darcy had identified transfers of about 15.99 million USDT and 5,783.81 TRX on the Tron network on October 22. Gupta responded that the flagged addresses belonged to infrastructure compromised in July 2025 and suggested the earlier attackers might be reusing those addresses, characterising the concern as a possible false alarm.

Investigator ZachXBT disputed the idea that the wallets were dormant, pointing to an address beginning TQKJQ. He said a liquidity provider had continued using it for roughly ten months after the July 2025 breach, with transactions recorded as recently as April and May 2026. Bitquery’s findings likewise indicated the infrastructure processed deposits up to October 21 despite being classified as retired, though its investigation did not establish how the attacker obtained the private keys.

Regulatory questions remain open

CoinDCX is registered with India’s Financial Intelligence Unit as a reporting entity subject to anti-money laundering and counterterrorist financing requirements. Neither report says whether the exchange notified FIU-India, CERT-In or another Indian authority about the October 21 transfers, and no confirmed regulatory investigation or enforcement action was identified in the records reviewed by either outlet. CoinDCX said trading, deposits and withdrawals ran without restrictions throughout.

Why it matters

The episode puts a spotlight on how exchanges handle the long tail of deprecated deposit addresses, where users keep sending funds long after an infrastructure change. For CoinDCX customers the practical position is unchanged, since the company says segregated cold storage protected user balances and it covered the shortfall from its own books. For the wider market, the case is a reminder that wallet hygiene on both sides of the counter matters, and that investigator scrutiny can force a public correction of an exchange’s first account of an incident.

What to watch

The open questions are whether Indian regulators open a formal inquiry, whether any of the roughly $9.63 million routed to other exchanges is recovered or frozen further, and how quickly CoinDCX completes the promised strengthening of monitoring on its older wallet systems. The exchange has also said support for retired deposit addresses is temporary and urged users to verify their current address before sending funds.

Disclaimer: This article is for information only and is not investment, financial or trading advice. Cryptocurrency prices are highly volatile. Always do your own research.

Sources: CoinCentral, Crypto.news