What to Know

  • CoinDCX says it absorbed a $15.99 million USDT loss after an internal process failed to move deposits out of a retired wallet.
  • The wallet was part of old operational infrastructure that CoinDCX says was compromised during a security incident reported on July 19, 2025.
  • The exchange initially dismissed reports of suspicious outflows as a false alarm before later acknowledging the loss.
  • Some users continued sending funds to deprecated addresses after the exchange had retired them following the 2025 incident.
  • CoinDCX says those users’ portfolios were credited when deposits reached the deprecated wallet.
  • A secondary sweeping process was intended to move funds from the deprecated address into the primary CoinDCX wallet, but it failed for a particular period.
  • CoinDCX says customer balances, active wallets and trading systems were unaffected.
  • The company says all user funds remain safe in secure, segregated cold wallets protected by multi-layer custody and offline security controls.
  • CoinDCX acknowledged that it could have been more proactive in communicating the update.

CoinDCX Says It Will Absorb the Loss

CoinDCX, described as India’s largest crypto exchange by trading volumes, says it has absorbed a $15.99 million USDT loss linked to deposits that continued to reach a retired wallet address. The Mumbai-based platform said the issue was not tied to customer balances, active wallets or trading systems, and that the loss would be borne by the company.

The incident centers on wallet infrastructure that CoinDCX says had already been deprecated after a security incident reported on July 19, 2025. The exchange said the old wallet belonged to its previous operational setup and had been retired as a result of that earlier compromise. However, some users continued depositing funds to addresses connected with that deprecated infrastructure.

CoinDCX said it credited those users’ portfolios when funds arrived at the deprecated wallet. A secondary mechanism, described by the company as sweeping, was supposed to move those funds from the retired address into the primary CoinDCX wallet. The company said that sweeping process failed for a particular period, allowing deposits to accumulate in the deprecated address and ultimately leading to the $15.99 million USDT loss.

Suspicious Outflows First Drew On-Chain Attention

The issue became public after blockchain sleuths flagged about $16 million in suspicious outflows from wallets linked to the exchange. CoinDCX initially pushed back on the claims, with CEO Sumit Gupta describing the matter as a false alarm on X. The exchange’s position at that stage was that the addresses being cited were old, had been created in January 2025, and had not been used by CoinDCX since the July 2025 hack.

That earlier hack cost the exchange about $44 million, according to the details now surrounding the latest wallet issue. The latest loss is different in structure from a straightforward breach claim because CoinDCX has framed it as an internal process failure involving deprecated infrastructure, not as a fresh hack. The company’s public explanation does not identify who was behind the irregular fund movement or precisely how the funds were moved.

On-chain investigator ZachXBT challenged parts of the early explanation by saying at least one of the addresses, labeled TQKJQ, had been in use by a liquidity provider and had swept user deposits to CoinDCX’s current public hot wallet as recently as April and May 2026. That claim added pressure on the exchange to clarify whether the address was truly inactive in operational terms, or whether it remained connected to deposit flows through user behavior and internal processing.

Deprecated Addresses Created Operational Risk

The central issue is that some users continued to send funds to deprecated addresses after CoinDCX retired them. In crypto markets, deposit addresses can remain visible in user records, wallet address books, saved templates or third-party systems even after a platform changes its infrastructure. If a user sends funds to an old address, the exchange may still be able to recognize the deposit, but the safety and movement of those funds can depend on internal controls around address monitoring and asset sweeping.

CoinDCX said the users who sent funds to the old addresses were credited when the deposits reached the deprecated wallet. That means the customer-facing balance update took place even though the funds still needed to be moved from the old infrastructure into the exchange’s primary wallet environment. When the sweeping process failed for a particular period, the assets remained where they should not have remained: in a retired address connected to infrastructure that had previously been compromised.

For centralized crypto exchanges, this type of operational gap highlights the complexity of wallet lifecycle management. Retiring an address is not always enough if users can still send assets to it, if older integrations still recognize it, or if internal systems continue to credit deposits before final consolidation. Strong controls typically require clear user warnings, blocked or discouraged deposits to retired addresses where possible, persistent monitoring and reliable reconciliation between credited balances and actual wallet movements.

Customer Funds and Trading Systems Were Unaffected, Exchange Says

CoinDCX has emphasized that customer funds remain safe. The exchange said all user funds are held in secure, segregated cold wallets protected by multi-layer custody and offline security controls. Cold wallets are designed to remain offline, which reduces exposure to internet-based attacks and limits the ability of a malicious actor to access funds remotely.

The company also said customer balances, active wallets and trading systems were unaffected. That distinction matters because the loss described by CoinDCX is tied to funds accumulating in a deprecated address after customer portfolios had already been credited. In other words, the company is presenting the financial hit as an internal company loss rather than a customer loss.

Still, the episode raises questions for market participants about how exchanges manage old wallet infrastructure after a major security event. If an address is known to be tied to compromised infrastructure, users and counterparties may expect deposit flows to that address to be blocked, closely monitored or quickly swept. CoinDCX’s explanation suggests the intended sweep mechanism was in place, but did not work as expected for a particular period.

Communication Timeline Draws Scrutiny

CoinDCX acknowledged that it could have communicated more quickly. The exchange said it took time to conduct a thorough review of the deprecated infrastructure and confirm the sequence of events. It also said it shared the update once it had the complete picture.

The communications path is likely to remain a key focus for crypto market watchers because the exchange first dismissed the outflow reports before later confirming a company-level loss. In crypto, on-chain data often makes wallet movements visible before companies have completed internal investigations. That can create tension between the speed of public blockchain analysis and the slower process of confirming what happened inside an exchange’s systems.

For users, the most important immediate claim is that balances and trading systems were not affected. For the broader market, the incident adds another example of how operational processes, not only direct exploits, can generate significant losses. Wallet retirement, user deposit behavior, automated sweeping and reconciliation are all part of exchange security, especially after an earlier compromise.

Why the Case Matters for India’s Crypto Market

CoinDCX’s status as a major Indian exchange gives the incident broader significance. Large trading platforms are expected to maintain strong custody controls, transparent communication and resilient internal systems. A $15.99 million USDT company-absorbed loss may not directly affect customer portfolios if the exchange’s statement holds, but it can still influence trust, risk perception and expectations around disclosure standards.

The case also underscores a wider industry challenge: old addresses do not simply disappear from user workflows. Retail and institutional users may store deposit addresses across wallets, exchange accounts, spreadsheets, bots and liquidity systems. If those addresses are later deprecated, exchanges need processes that reduce the chance of funds accumulating in unsafe or obsolete infrastructure.

Market participants will now watch whether CoinDCX provides additional technical detail about the failed sweeping process, the period during which it failed, and the controls added to prevent similar issues. The exchange has not described the latest irregular movement as a hack, and its public explanation leaves open questions about who moved the funds and how the movement occurred.

For now, CoinDCX’s central message is that the loss has been absorbed by the company, user balances remain safe, and active infrastructure was not affected. The incident nevertheless serves as a reminder that exchange security is not only about stopping external attacks. It is also about ensuring that internal processes continue to work correctly after compromised systems are retired.

Frequently Asked Questions (FAQs)

What happened at CoinDCX?

CoinDCX says it absorbed a $15.99 million USDT loss after an internal process failed to move deposits out of a deprecated wallet address tied to old operational infrastructure.

Were CoinDCX customer balances affected?

CoinDCX says customer balances were not affected. The exchange said the loss was absorbed by the company and that user funds remain safe.

Was this described as a new hack?

CoinDCX’s public explanation does not describe the latest issue as a new hack. The company tied the loss to a failed sweeping process involving a retired wallet connected to infrastructure compromised during the July 19, 2025 security incident.

How much money did CoinDCX lose?

CoinDCX said the loss totaled 15.99 million USDT, which it is absorbing as a company loss.

Why were users still sending funds to retired addresses?

CoinDCX said some users mistakenly continued depositing funds into deprecated addresses after the exchange retired them following the 2025 incident.

What was the sweeping process supposed to do?

The sweeping process was intended to move funds from the deprecated address into the primary CoinDCX wallet after deposits reached the old address.

Did CoinDCX’s active wallets or trading systems fail?

CoinDCX says its active wallets and trading systems were unaffected by the incident.

What did CoinDCX say about cold wallets?

CoinDCX said user funds remain in secure, segregated cold wallets protected by multi-layer custody and offline security controls.

Why did communication around the incident draw attention?

The exchange initially dismissed reports of suspicious outflows as a false alarm before later acknowledging the loss, and it said it could have been more proactive in sharing the update.