CoinDCX Reports $15.99 Million Loss After Retired Wallet Process Failure

Highlights

CoinDCX said it absorbed a loss of $15.99 million USDT after an internal process failed to move customer deposits from a retired wallet into the exchange’s primary wallet. The address was part of older infrastructure compromised during a security incident reported on July 19, 2025. Although CoinDCX had deprecated the address, some users continued to send funds to it, and a secondary “sweeping” service did not transfer deposits for a particular period. The exchange said customer balances, active wallets, and trading systems were unaffected. CoinDCX acknowledged that it could have communicated more proactively while reviewing the incident.

Sentiment Analysis

• Overall sentiment: Mixed, with a cautious and predominantly factual tone. The report centers on a material financial loss and an operational failure, which create a negative impression of the exchange’s internal controls and incident response. The disclosed amount, $15.99 million USDT, and the link to a previously compromised wallet are serious details.


• At the same time, the article includes CoinDCX’s statements that customer balances, active wallets, and trading systems were unaffected, and that customer funds remain in segregated cold wallets. These assurances provide a counterbalancing note but are presented as the company’s claims rather than independent verification.


• The exchange’s explanation that some customers continued to use deprecated addresses clarifies how deposits accumulated, while its acknowledgment that disclosure could have been quicker adds an element of accountability. The article does not establish who caused the irregular movement or whether the retired addresses were compromised again.


• Sentiment balance: The story is not framed as wholly negative or positive. Its emphasis on unresolved questions and the loss makes the overall assessment cautious and mixed.

Article Text

CoinDCX, described as India’s largest cryptocurrency exchange by trading volumes, said it absorbed a loss of $15.99 million USDT following a failure in an internal process for handling deposits. The incident involved a retired wallet address that remained reachable after the exchange had stopped using it. Some users continued to send funds to the deprecated addresses, while a service intended to transfer those deposits to CoinDCX’s primary wallet failed for a particular period.

The issue drew attention after blockchain investigators flagged about $16 million in suspicious outflows from wallets associated with the Mumbai-based exchange. CoinDCX initially rejected reports that the activity was connected to its current operations. CEO Sumit Gupta described the reports as a false alarm on X, and a spokesperson told CoinDesk that the addresses identified by investigators were old addresses created in January 2025. The exchange said those addresses had been compromised in a July 2025 hack and had not been used by CoinDCX since.

That initial account was challenged by ZachXBT, an on-chain investigator. He said at least one address, labeled TQKJQ, had been used by a liquidity provider and had swept user deposits to CoinDCX’s current public hot wallet as recently as April and May 2026. The activity raised questions about whether the retired address had continued to play a role in deposit handling despite the exchange’s statement that it was no longer in use.

On Sunday, CoinDCX published a blog post addressing activity associated with TQKJQ. The company said the wallet belonged to its old operational wallet infrastructure and had been compromised during the security incident it reported on July 19, 2025. CoinDCX said it deprecated the wallet as a result of that incident.

The post explained that customers sometimes continued to deposit funds into deprecated addresses after the 2025 hack. CoinDCX said it credited those users’ portfolios as soon as the funds reached the old wallet. A secondary service, described by the exchange as “sweeping,” was intended to move money from a deprecated address into the primary CoinDCX wallet. The process did not function for a particular period, leaving deposits accumulated in the retired address.

CoinDCX said the failed transfer process resulted in a $15.99 million USDT loss, which the company absorbed. The blog post did not describe the event as a new hack. It also did not identify who was responsible for the irregular movement of funds or explain exactly how that movement occurred. CoinDesk said it contacted CoinDCX to ask whether the exchange believed the old addresses had been compromised again; the article does not report an answer.

CoinDCX said user funds remained safe in secure, segregated cold wallets, protected by multi-layer custody and offline security controls. Cold wallets are designed to remain offline. The exchange also said customer balances, active wallets, and trading systems were unaffected by the incident. These assurances address the status of customer accounts, while the disclosed loss concerns funds associated with deposits left in the retired wallet.

The company said it needed time to conduct a thorough review of the deprecated infrastructure and confirm the sequence of events. It acknowledged that it could have been more proactive but said it shared an update after it had a complete picture. The incident therefore raised two distinct issues: the operational failure that prevented deposits from being swept into the primary wallet, and the timing and clarity of the exchange’s public communications.

The report describes the exchange’s account and the questions raised by on-chain activity, but it does not resolve the cause of the irregular movement or determine whether the retired addresses experienced another compromise. CoinDCX’s published explanation focuses on the deposit-sweeping process and the loss the company says it absorbed. The broader details remain subject to clarification.

Key Insights Table