Mentioned in This Article
1. What did CoinDCX say about the $16 million loss?
CoinDCX, India's largest crypto exchange by trading volume, said on October 25 that an internal process failed to move customer deposits out of a retired wallet, causing a loss of about 15.99 million USDT, roughly $16 million. The Mumbai-based company will absorb the CoinDCX loss itself instead of passing it to users.
In its own account, the exchange said customer balances, its active wallets and its trading systems were not affected. It also said that customer assets continue to sit in segregated cold wallets protected by multiple layers of custody and offline controls. The statement did not call the episode a hack, and it left open the question of who moved the money out of the old addresses.
2. How did the outflows first come to light?
The matter began the previous week, when blockchain investigators pointed to around $16 million in suspicious outflows from wallets linked to the exchange. Sumit Gupta, CoinDCX's chief executive, answered publicly on X and described the reports as a false alarm. The company's position was that the flagged activity had nothing to do with its operations.
A company spokesperson reinforced that line on October 23. The spokesperson said the flagged addresses were old ones, created in January 2025, and that they had been compromised in a July 2025 breach in which the exchange lost about $44 million. According to that explanation, CoinDCX had not used the addresses since, so any movement of funds from them could not be tied to the exchange.
3. Why did on-chain evidence contradict the first denial?
That explanation was challenged by ZachXBT, a well-known on-chain investigator. He said at least one of the flagged addresses, labeled TQKJQ, had been used by a liquidity provider and had swept user deposits into CoinDCX's current public hot wallet as recently as April and May 2026. If correct, the address was still part of a working deposit flow well after the exchange said it had stopped using it.
His finding mattered because it undercut the claim that the wallet was dormant. A sweep into a live hot wallet is the sort of routine plumbing that exchanges rely on, and it implied the old address was still receiving customer money months after the stated retirement. The public disagreement pushed the company to provide a fuller account.
4. What does the company's fuller explanation say?
CoinDCX followed up with a blog post, which the article describes as appearing on Sunday. In it the exchange acknowledged that TQKJQ belonged to its old operational wallet infrastructure and that the loss was connected to that address. It described the infrastructure as having been compromised in the July 19, 2025 incident and deprecated afterward.
The post then laid out how funds ended up exposed. Some users, the company said, had continued to send deposits to the deprecated addresses even after they were retired. Whenever funds reached the retired wallet, CoinDCX credited those users' portfolios straight away, so customers saw their balances updated as normal. The money, however, was sitting in an address that the exchange no longer controlled safely.
5. How did the failed sweeping process leave deposits exposed?
A secondary service, which the exchange calls sweeping, was supposed to collect those deposits and move them into the primary wallet. Sweeping is a common exchange practice: customers are given deposit addresses, and the operator periodically consolidates the balances into a central wallet so that funds can be managed in one place and the deposit addresses are left empty.
According to CoinDCX, that process failed for a certain period. During that time, deposits accumulated in the deprecated address instead of being moved onward. The company said about 15.99 million USDT was lost as a result, and that it was absorbed by the company. Because users had already been credited, covering the shortfall from its own resources meant their balances stayed intact.
6. What is the difference between hot, cold and retired wallets?
Exchanges typically divide their holdings between wallets with different risk profiles. A hot wallet is connected to the internet so that it can process withdrawals quickly, which makes it convenient but more exposed. Cold wallets keep the signing keys offline and hold the bulk of customer assets, trading speed for safety. Retired or deprecated wallets are older addresses that an operator has stopped using, usually after a security event or an infrastructure upgrade.
The distinction explains why CoinDCX could say that customer funds were untouched while still reporting a loss of about $16 million. The money that vanished was not in the cold storage that backs customer holdings. It had arrived in an old address after the exchange had already credited the depositors, so the exposure sat in a gap between the retired infrastructure and the current one. The users were made whole by the company, but the incident shows how a single stale address can become a liability.
7. What remains unexplained?
The blog post leaves several gaps. It does not describe the incident as a hack, it does not say who moved the funds out of the retired wallet, and it does not explain how the movement took place. CoinDesk asked CoinDCX whether the retired addresses had been hacked a second time, and the article does not report a reply.
Those open points are significant for a plain reason. If an address was compromised in July 2025, the party that gained access then may still have held the keys to it. Any later deposits that landed there would have been exposed to whoever possessed that access, whether or not a fresh intrusion occurred. The company's account is silent on this mechanism, so readers are left without a clear picture of how the $16 million actually left.
The earlier incident is the backdrop to the whole episode. The July 19, 2025 compromise cost the exchange roughly $44 million, according to the figure the spokesperson cited. After that event, the infrastructure tied to the affected wallets was deprecated, meaning the exchange moved to new wallets and told users to stop depositing into the old ones.
The latest disclosure shows that retiring wallets on paper is only part of the job. Deposit addresses that customers have saved, bookmarked or handed to third parties can remain in use long after an operator moves on. Where an exchange keeps crediting funds sent to such addresses, it needs a dependable process to collect them, or to block and flag them, so that nothing lingers in a location that is no longer secure.
8. Why does a retired deposit address stay dangerous?
A deposit address does not expire. Anyone holding the address can send funds to it at any time, and blockchains will process the transfer without checking whether the recipient still wants it. When a platform changes its wallet layout, it has to make sure that every old address either keeps being monitored and swept or stops being presented to customers altogether. A gap in either task can leave funds waiting in a place that nobody is responsible for protecting.
In this case, the company said users continued to send money to the deprecated addresses and that CoinDCX credited their portfolios as soon as the funds arrived. Crediting on arrival is a customer-friendly choice, since it spares users from losing money over a mistaken address. It also means the exchange carries the risk until the funds are secured, which is what the failed sweeping process turned into a realized loss of roughly 15.99 million USDT.
USDT is a dollar-pegged stablecoin, so a loss denominated in it is straightforward to measure in dollars, which is why the exchange could quote a figure of about $16 million. The size of the loss, relative to the roughly $44 million lost in July 2025, makes the new episode a substantial second financial blow for the exchange, one that it has chosen to absorb rather than pass on to customers, and one that raises fresh questions about how its older infrastructure was wound down.
9. How did CoinDCX handle disclosure?
The company conceded that it could have been more proactive. It said that reviewing the deprecated infrastructure and confirming the sequence of events took time, and that it shared the update once it had the full picture. That framing admits the delay while maintaining that it wanted its figures to be accurate before speaking.
The sequence nonetheless left a visible gap between the first public message and the later one. The first reply called the reports a false alarm and said the activity was unconnected to the exchange. Within days, the company confirmed a loss of about $16 million tied to an address from its own former infrastructure. For customers, the change in tone is likely to be the part that draws the most scrutiny.
10. What does this mean for users and what comes next?
For account holders, the exchange's message is that funds held in segregated cold wallets are safe and that trading and active wallets are working normally. Cold wallets are kept offline by design, which removes them from direct exposure to internet-based attacks, and CoinDCX pointed to that arrangement as the reason user assets were not touched.
Several questions are still pending: whether the company will name who moved the funds, whether it will confirm if the retired addresses were accessed again, and what changes it will make to its sweeping and address-retirement procedures. The article reports no date for any further statement from CoinDCX, so those answers will depend on what the exchange chooses to publish.