CoinDCX admits $16M theft three days after CEO called it a false alarm

What happened

CoinDCX has confirmed that about $16 million in cryptocurrency was taken from retired deposit wallets, three days after its chief executive publicly dismissed the transfers as a false alarm. The Indian exchange said the funds sat in infrastructure compromised during its July 2025 breach and that it would absorb the loss rather than pass it to customers.

Blockchain observers first flagged the movement on Oct. 21, tracing roughly 15.99 million USDT out of CoinDCX-linked addresses on the Tron network; the funds were subsequently split between several large exchanges. CEO Sumit Gupta pushed back the following day, saying the addresses had been compromised in the earlier attack and no longer formed part of the exchange's working infrastructure.

In an Oct. 25 company update, CoinDCX accepted that the 15.99 million USDT had in fact left its deprecated wallets. According to the exchange, some users and platforms kept sending deposits to old addresses even after being told to switch, and an automated service meant to sweep those deposits into secure wallets malfunctioned, letting balances build up in addresses attackers could still reach. Coinpedia reported that the drain covered 44 transfers and included 5,784 TRX alongside the stablecoins.

Why it matters

The reversal puts attention on how exchanges wind down deposit addresses, particularly ones tied to a previous hack. CoinDCX says affected customer accounts were credited, cold storage was untouched and trading and withdrawals ran normally, but the episode shows that a retired address can keep collecting customer money long after a breach, and that a single failed internal process can leave those funds exposed. It also raises questions about how exchanges communicate during an active investigation, since the company's first public position was a denial.

What the data shows

The stolen amount was 15.99 million USDT plus 5,784 TRX, moved across 44 transactions starting Oct. 21. CoinDCX said Tether later froze about $2.21 million of the funds. The July 2025 breach was reported at $44 million, and the two events together come to nearly $60 million in losses borne by the company.

Background

CoinDCX suffered a breach on July 19, 2025, that it has said cost about $44 million. In the aftermath, the exchange asked users to move to new deposit addresses, but continued to accept transfers sent to the old ones and credit them to customer accounts. Bitcoin.com News reported that the exchange has now absorbed close to $60 million in losses across the two incidents, which are roughly 15 months apart.

What is still unclear

Independent investigators have disputed part of the company's explanation. ZachXBT, who first reported the suspected theft, pointed to evidence that some of the addresses remained in use for months after the 2025 breach, and Bitquery's separate analysis found wallet activity continuing into October 2026, at odds with the suggestion that the infrastructure had been fully abandoned. The reports do not establish exactly when each address stopped being monitored or how long deposits had been accumulating.

What to watch

Attention now turns to whether the frozen Tether funds are returned, how CoinDCX closes off the remaining old addresses, and whether Indian regulators or other exchanges respond. The case is also likely to be cited in arguments that exchanges should automatically retire and block deposits to addresses compromised in a breach, rather than relying on users to migrate.

Questions readers ask