CoinDCX confirms $15.99 million loss after failed wallet sweep

What happened

CoinDCX has confirmed that it absorbed a loss of 15.99 million USDT after an automated service designed to move customer deposits out of retired wallet addresses stopped working, allowing funds to build up in infrastructure the exchange had already deprecated. In an update dated Oct. 25, the Indian exchange said its active wallets, trading systems and customer deposit balances were not affected by the incident.

According to the company's account, customers continued sending funds to addresses that had been retired after a July 2025 security incident, and those deposits were credited to their portfolios. A secondary automated process was supposed to sweep the money into primary wallets. That process failed for a period, so the deposits remained in the old addresses rather than being moved to current infrastructure.

The confirmation came after blockchain investigators publicly flagged unusual outflows from addresses tied to CoinDCX. Chief executive Sumit Gupta had earlier rejected suggestions that the activity amounted to a new breach, describing the reports as a possible false alarm. On-chain investigator ZachXBT challenged that position, citing transaction activity indicating that at least one of the disputed addresses had still been processing deposits in 2026. CoinDCX subsequently acknowledged the loss and offered the failed-sweep explanation instead.

The exchange said its review took time and conceded it could have been more proactive in updating users. It has not identified who was responsible for the movement of funds or provided a full technical account of how the sweep failure occurred.

Why it matters

The episode points to a risk that outlasts the incident that creates it: decommissioning a wallet does not remove exposure if customers can still send funds to its address, or if legacy keys and automated processes tied to it remain in place. Deposits can quietly accumulate in infrastructure that receives less scrutiny than live systems, and the resulting balances may only become visible when an outside investigator notices unusual transfers.

The timeline also raises questions about monitoring and communication. CoinDCX's initial dismissal of the reports, followed by a confirmation of the loss, shifts the story from a dispute over suspicious transactions to an acknowledged financial hit. The exchange's assurances about unaffected systems are its own statements and have not been independently verified, and the reports do not establish every technical detail of the event.

What the data shows

Blockchain data firm Bitquery reported that about 15.99 million USDT was drained from 40 CoinDCX-linked TRON wallets. Roughly 15.82 million USDT of the total originated from a single address where deposits had accumulated, a concentration consistent with the exchange's account that funds were left sitting in deprecated infrastructure after the sweeping process stopped functioning. CoinDCX said the 15.99 million USDT loss was borne by the company itself rather than by customers.

Background

CoinDCX says the affected addresses formed part of operational wallet infrastructure that was compromised during a security incident in July 2025, which cost the exchange approximately $44 million. That infrastructure was deprecated afterward, but deposit addresses linked to it remained reachable by users, according to the company's explanation. The Oct. 21 wallet activity that drew investigator attention came months after the earlier incident had been publicly disclosed and the wallets retired.

What is still unclear

CoinDCX has not said why the automated sweep failed or how long it had been inoperative before the outflows were noticed. It also has not established who was responsible for the irregular movement of funds. The reports describe the loss as an operational failure involving retired wallets, but do not resolve whether any external party was involved or how the funds left the addresses.

What to watch

The next points to watch are whether CoinDCX publishes a fuller technical account of the sweep failure and whether it details any changes to how retired addresses are monitored. The case is also likely to feed into broader industry scrutiny of how exchanges track deprecated deposit addresses, private-key exposure and automated transfer failures, and how quickly they communicate when outside researchers flag unusual activity. CoinDesk, Bitcoinist and Crypto Daily all reported on the sequence of events.

Questions readers ask