Indian cryptocurrency exchange CoinDCX has confirmed losing 15.99 million USDT, approximately $16 million, after an automated system failed to transfer customer deposits out of wallet infrastructure compromised during a previous security breach.
The disclosure, published October 25, 2026, follows several days of scrutiny from blockchain investigators who identified suspicious transfers from addresses associated with the exchange. CoinDCX initially rejected suggestions of a new loss, maintaining that the affected wallets had been retired following a July 2025 incident that cost approximately $44 million.
However, the company subsequently acknowledged that customers continued depositing cryptocurrency into those addresses and that a failure in its automated wallet-sweeping process allowed funds to accumulate. The exchange said it absorbed the entire $15.99 million loss and maintained that customer balances, active wallets and trading systems remained unaffected.
The incident raises questions about the management of compromised infrastructure and the effectiveness of safeguards intended to protect deposits sent to outdated addresses.
Failed Sweeping Service Exposed Deposits in Retired Wallets
According to CoinDCX’s October 25 statement, the affected address belonged to operational infrastructure deprecated after the July 19, 2025 security breach. Despite instructions to use updated deposit addresses, some customers continued transferring cryptocurrency to the older wallets.
CoinDCX maintained a recovery mechanism that credited these deposits to customer accounts while a separate automated service transferred the underlying funds into active wallets. The arrangement was intended to prevent customers from losing access to assets mistakenly sent to outdated addresses.
However, the sweeping service stopped functioning for an unspecified period, allowing deposits to accumulate in the vulnerable infrastructure. CoinDCX said it detected unusual system activity on October 21 and subsequently identified irregular blockchain transfers.
Further investigation established that the failed sweeping process had contributed to the 15.99 million USDT loss. The company has not disclosed when the service stopped working, how the vulnerability was exploited or whether the same attackers responsible for the 2025 incident were involved. It also acknowledged that its initial public communication could have been more proactive.
Blockchain Investigators Challenged Initial Denials
The confirmation follows investigations by blockchain researchers Darcy, ZachXBT and Bitquery, who questioned CoinDCX’s original explanation. On October 21, investigators identified approximately 15.99 million USDT moving from TRON wallets linked to the exchange.
CoinDCX co-founder and chief executive Sumit Gupta initially described the reports as a possible false alarm, arguing that the addresses were no longer operational. However, ZachXBT pointed to evidence that some addresses continued processing deposits after the previous breach.
Bitquery subsequently examined 40 affected wallets and identified approximately $15.82 million accumulated in one address through 88 deposits. Its investigation also traced approximately $9.63 million through intermediary wallets to addresses associated with Binance, OKX and Gate.
Those findings supported concerns that the supposedly retired infrastructure continued handling customer funds. CoinDCX’s latest statement confirms the central operational failure, although questions remain about the precise mechanism of the unauthorized transfers.
The incident follows the exchange’s approximately $44 million loss in July 2025, when attackers compromised an internal operational account used for liquidity provisioning. Together, the two incidents represent approximately $60 million in disclosed losses, although they occurred through different circumstances.
CoinDCX maintains that customer assets remain protected through segregated custody arrangements and that trading, deposits and withdrawals continued without interruption. The exchange has advised customers to use only current deposit addresses and indicated that additional safeguards are being implemented.
For cryptocurrency exchanges, the incident highlights the risks of maintaining recovery services connected to previously compromised infrastructure. For CoinDCX, the immediate challenge is demonstrating that the operational weaknesses behind the latest loss have been addressed and that its custody controls remain effective.
