April

Read

ZachXBT

when

<p>CoinDCX has confirmed losing 15.99 million USDT through compromised wallet infrastructure after initially rejecting claims that nearly $16 million had been stolen from the Indian cryptocurrency exchange.</p>
<div id="cn-block-summary-block_6f30333402653989a1df8ab67c488f8e" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>CoinDCX confirmed losing 15.99 million USDT after initially dismissing reports of suspicious wallet transfers.</li>
   <li>A failed automated sweeping service allowed deposits to accumulate in wallets compromised during July 2025.</li>
   <li>Blockchain investigators traced continued activity through supposedly retired wallets, challenging CoinDCX’s initial explanation.</li>
   <li>CoinDCX says it absorbed the losses, leaving customer balances, active wallets, and trading services unaffected.</li>
  </ul>
 </div>
</div>
<p>CoinDCX, in an October 25 <a href="https://coindcx.com/blog/coindcx-news/on-chain-wallet-activity-update-21-oct-2026" rel="noopener noreferrer nofollow">statement</a>, acknowledged that an October 21 incident affected its old operational wallets, which it had retired following a $44 million security breach in July 2025.</p>
<p>The exchange said a failure in its automated deposit-sweeping service allowed cryptocurrency to accumulate at an address that customers continued using despite instructions to switch to newer wallets. CoinDCX absorbed the resulting loss and maintained that customer balances and active trading systems were not affected.</p>
<h2 class="wp-block-heading" id="strong-coindcx-reverses-its-position-on-the-15-99-million-loss-strong"><strong>CoinDCX reverses its position on the $15.99 million loss</strong></h2>
<p>The admission follows several days of disagreement between CoinDCX executives and blockchain investigators over suspicious transactions involving wallets linked to the exchange.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>Update on the on-chain Wallet Activity – 21st October 2026<br>Our full update on the recent on-chain activity, what happened, and what it means for you.<br>User funds remain safe, and trading and withdrawals continue as usual.<br>Read the full update: <a href="https://t.co/fSr10QlkJh" rel="noopener noreferrer nofollow">https://t.co/fSr10QlkJh</a></p>— CoinDCX (@CoinDCX) <a href="https://x.com/CoinDCX/status/2114214560848888011?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 25, 2026</a>
  </blockquote>
 </div>
</figure>
<p>On October 22, CoinDCX CEO Sumit Gupta rejected suggestions of another security breach, saying the flagged addresses belonged to infrastructure compromised in July 2025. He maintained that no funds had moved from current operational wallets into the addresses under scrutiny.</p>
<p>As crypto.news <a href="https://crypto.news/coindcx-denies-second-hack-claims-as-zachxbt-questions-wallet-activity/" rel="noopener noreferrer nofollow">previously reported on October 22</a>, blockchain investigator Darcy had identified transfers involving approximately 15.99 million USDT and 5,783.81 TRX on the Tron network.</p>
<p>Gupta suggested that the previous attackers might have been reusing the compromised addresses, describing the concerns as a possible false alarm.</p>
<p>You might also like: <a href="https://crypto.news/coindcx-denies-second-hack-claims-as-zachxbt-questions-wallet-activity/" rel="noopener noreferrer nofollow"> CoinDCX denies second hack claims as ZachXBT questions wallet activity </a></p>
<p>However, the company’s latest statement confirms that deposits continued arriving at those addresses and that its own systems were responsible for transferring them to secure wallets when the automated service functioned correctly.</p>
<p>CoinDCX said it noticed unusual activity on October 21 but discovered irregular fund movements the following day through blockchain records and community reports.</p>
<p>The company acknowledged that its communication could have been better. “We could have been more proactive,” it said, explaining that the investigation took time to establish the sequence of events.</p>
<h2 class="wp-block-heading" id="strong-why-were-compromised-coindcx-wallets-still-processing-deposits-strong"><strong>Why were compromised CoinDCX wallets still processing deposits?</strong></h2>
<p>The latest disclosure explains why wallets compromised more than a year ago continued handling customer transactions.</p>
<p>According to CoinDCX, some customers continued sending cryptocurrencies to previously issued deposit addresses even after the exchange replaced its compromised infrastructure.</p>
<p>Instead of abandoning the deposits, the company maintained a recovery process that credited customers immediately when their funds arrived.</p>
<p>A separate automated service then moved the deposited cryptocurrency from the retired addresses into secure operational wallets. CoinDCX said this arrangement allowed users to access their credited balances without waiting for transfers between wallets to finish.</p>
<p>However, the company has not disclosed when the sweeping service stopped working, how long the funds accumulated, or precisely how unauthorized parties gained control of the money.</p>
<p>Blockchain investigator ZachXBT had questioned the claim that the wallets were no longer being used, pointing to an address beginning TQKJQ.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>Withdraw all funds from CoinDCX if you value your assets. <br><br>Its co-founders are clowns running a circus. <br><br>They publicly and privately denied a theft of its assets occurred meaning they straight up lied or are negligently incompetent. <br><br>Later they disclosed the $16M theft and… <a href="https://t.co/uEmtogPonq" rel="noopener noreferrer nofollow">pic.twitter.com/uEmtogPonq</a></p>— ZachXBT (@zachxbt) <a href="https://x.com/zachxbt/status/2113264816546873716?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 22, 2026</a>
  </blockquote>
 </div>
</figure>
<p>He alleged that a liquidity provider continued using the address for roughly 10 months after the July 2025 breach, with transactions recorded as recently as April and May 2026.</p>
<p>Separate blockchain analysis by Bitquery <a href="https://bitquery.io/investigations/coindcx-hack" rel="noopener noreferrer nofollow">identified</a> additional activity. Its investigation traced routine deposit movements through affected addresses up to October 21 and found that 88 deposits totaling approximately 15.82 million USDT had accumulated in one wallet.</p>
<p>The findings indicate that the wallet infrastructure continued processing transactions after CoinDCX classified it as retired, although the investigation did not establish how the attacker obtained the private keys.</p>
<h2 class="wp-block-heading" id="strong-blockchain-investigators-trace-funds-to-other-exchanges-strong"><strong>Blockchain investigators trace funds to other exchanges</strong></h2>
<p>The October 21 transfers involved more than one wallet, according to Bitquery’s examination of Tron blockchain records.</p>
<p>Its investigation identified 40 affected addresses and traced approximately $9.63 million through intermediary wallets to deposit addresses associated with OKX, Binance, and Gate within 18 hours of the main transfer.</p>
<p>The analysis found that Tether subsequently froze approximately $2.21 million across nine wallets on October 22. CoinDCX’s official statement did not disclose any asset recovery or identify the recipients of the missing funds.</p>
<p>During the previous <a href="https://crypto.news/coindcx-blames-server-breach-44-million-exploit-2025/" rel="noopener noreferrer nofollow">July 2025 security breach</a>, CoinDCX attributed the $44 million loss to a sophisticated server compromise affecting an internal liquidity account.</p>
<p>Subsequently, the company <a href="https://crypto.news/coindcx-live-again-inr-withdrawals-reopen-44m-breach/" rel="noopener noreferrer nofollow">restored normal trading operations</a> and said its segregated customer custody arrangements had prevented losses to users.</p>
<h2 class="wp-block-heading" id="strong-will-indian-regulators-investigate-the-latest-coindcx-incident-strong"><strong>Will Indian regulators investigate the latest CoinDCX incident?</strong></h2>
<p>CoinDCX is registered with India’s Financial Intelligence Unit as a reporting entity subject to anti-money laundering and counterterrorist financing requirements.</p>
<p>However, the exchange’s October 25 disclosure did not mention whether it had notified FIU-India, CERT-In, or another Indian authority about the latest incident.</p>
<p>No confirmed regulatory investigation or enforcement action concerning the October 21 transfers was identified in the reviewed records.</p>
<p>CoinDCX said trading, deposits, and withdrawals continued without restrictions throughout the incident. It plans to strengthen monitoring of older wallet systems and remind customers that support for retired deposit addresses is temporary.</p>
<p>The exchange has advised customers to verify their current deposit addresses before transferring cryptocurrency, warning that sending funds to deprecated wallets carries substantial risk.</p>
<p>Read more: <a href="https://crypto.news/crypto-market-watch-worst-altcoins-bitcoin-price-80k/" rel="noopener noreferrer nofollow"> Bitcoin price battles $80K as major altcoins post double-digit losses: Market watch </a></p>

CoinDCX admits $15.99M loss days after denying hack claims

Table of Contents

crypto.news

Other articles published on Oct 25, 2026

Join our free newsletter for daily crypto updates!