CoinDCX admits $16 million USDT loss days after CEO called breach reports a ‘false alarm’

25 Oct 2026

25 Oct 2026, 20:05 UTC+01:00

Exchanges TradeReviewed News Desk

CoinDCX, one of India’s largest crypto exchanges, has confirmed it lost 15.99 million USDT, roughly $16 million, from deposit wallets it had stopped using after its 2025 hack. The admission, published in a company blog post early Sunday and reported by The Block, comes only days after co-founder and CEO Sumit Gupta told users on X that breach reports sounded like “a false alarm.”

What CoinDCX now says happened

According to the blog post, CoinDCX noticed unusual activity on Tuesday that affected its “old, deprecated wallet infrastructure which had unknown vulnerabilities.” The exchange said its automated sweeping service, which moves funds between its wallets, failed for a period of time. As a result, user deposits built up at an address it no longer used, and that balance was taken.

CoinDCX said the loss was absorbed by the company, that user funds remain in segregated cold wallets, and that trading, deposits and withdrawals continued as normal.

From denial to admission

The outflows were first flagged on Wednesday by Darcy, co-founder of asset recovery service FlashRescue. Darcy reported that about 15.99 million USDT and 5,783.81 TRX left CoinDCX’s hot wallet and several deposit addresses on Tuesday, all going to a single Tron address. The largest single transfer was 15,819,002 USDT, and the funds were then split and routed to deposit addresses at Binance, OKX and Gate, per Darcy.

Gupta replied within hours that the claim was “incorrect,” that CoinDCX wallets were not breached, and that hackers appeared to be reusing addresses compromised in July 2025. The exchange’s official account called the reports “misleading.”

On-chain investigator ZachXBT disputed that account. He said one deposit address had been used by a liquidity provider for 10 months after the July 2025 incident and had swept user deposits to CoinDCX’s current hot wallet as recently as April and May 2026. Later the same day, CoinDCX acknowledged that its sweeping process had failed and caused “operational losses,” without giving a figure. ZachXBT advised users to withdraw their funds, while also saying he helped freeze a six-figure sum of the stolen crypto on the exchange’s behalf.

A pattern of incidents

CoinDCX lost about $44 million in a July 2025 hack. Bengaluru police later said attackers posing as recruiters tricked an engineer into installing malware on a company laptop. In March, Indian police arrested Gupta and co-founder Neeraj Khandelwal over a fraud complaint that CoinDCX said stemmed from scammers running a copycat site. Coinbase invested in CoinDCX in October 2025 at a valuation Gupta put at $2.45 billion.

Asked about the earlier denials, CoinDCX’s PR agency referred The Block to the blog post.

What it means for traders

• Old addresses are a real risk. If an exchange retires deposit addresses after a hack, confirm your saved deposit address is current before every transfer. Never reuse an address from an old address book entry.
• Transparency matters as much as reserves. A company covering a loss is good news for users, but a public denial followed by an admission is a warning sign. Clear incident reporting is part of how we score platforms in our testing method.
• Limit exchange exposure. Keep only trading balances on any exchange and compare security track records in our exchange comparison, including reviews of BingX and OKX.

This is not financial advice.

Related reviews

• Bingx review
• Okx review

Sources

• The Block: CoinDCX confirms $16 million loss from retired wallets days after CEO called breach reports a 'false alarm'

News is for information only and is not financial advice. More crypto news