Security

Million

ZachXBT

<h3 id="summary">Summary</h3>
<div>
 <div>
  <div>
   <ul>
    <li>CoinDCX confirmed a $16 million cryptocurrency theft involving outdated deposit wallets, with the exchange absorbing losses while protecting customer funds.</li>
    <li>Blockchain investigators challenged CoinDCX’s initial breach denial, revealing suspicious transfers involving USDT and TRX through compromised addresses linked to exchanges.</li>
    <li>The incident follows CoinDCX’s $44 million hack in 2025, bringing combined losses to $60 million despite assurances of normal operations.</li>
   </ul>
   <p>&nbsp;</p><br>
  </div>
 </div>
</div>
<div>
 <p>Indian cryptocurrency exchange CoinDCX has confirmed a $16 million security breach, raising concerns over its handling of previously compromised wallets. The admission follows public denials from its leadership, who initially dismissed reports of suspicious transfers as inaccurate.</p><br>
 <p>CoinDCX disclosed that attackers drained 15.99 million USDT from outdated deposit infrastructure linked to its July 2025 security incident. The company identified unusual activity on Tuesday and subsequently investigated vulnerabilities affecting wallets it had stopped using.</p><br>
 <p><a href="https://coindcx.com/blog/coindcx-news/on-chain-wallet-activity-update-21-oct-2026" rel="noopener noreferrer nofollow">According to CoinDCX’s official blog update</a>, its automated wallet sweeping system failed for a period, allowing customer deposits to accumulate. Attackers exploited the exposed infrastructure and transferred approximately $16 million before the exchange identified the losses.</p><br>
 <p>Despite the incident, CoinDCX maintained that customer assets remain protected through segregated cold storage and additional security measures. The exchange also confirmed that it absorbed the financial losses without affecting customers’ account balances.</p><br>
 <p><strong>Also Read: </strong><a href="https://36crypto.com/crypto-bloodbath-bitcoin-slips-toward-80000-as-ethereum-xrp-and-solana-extend-losses/" rel="noopener noreferrer nofollow">Crypto Bloodbath: Bitcoin Slips Toward $80,000 as Ethereum, XRP, and Solana Extend Losses</a></p><br>
 <h2 id="blockchain-investigators-challenge-coindcx-s-initial-denial">Blockchain Investigators Challenge CoinDCX’s Initial Denial</h2>
 <p>The disclosure followed findings from blockchain investigators who questioned CoinDCX’s earlier statements about its compromised wallet addresses.</p><br>
 <p>According to FlashRescue co-founder Darcy, suspicious transactions involved approximately 15.99 million USDT and 5,783.81 TRX leaving several exchange addresses. The transfers occurred Tuesday, with the stolen assets initially reaching a single address on the Tron network.</p><br>
 <p>Investigators identified one transfer involving 15,819,002 USDT, representing the majority of the stolen cryptocurrency. Darcy reported that the funds subsequently moved through multiple addresses connected to Binance, OKX, and Gate.</p><br>
 <p>CoinDCX CEO Sumit Gupta initially rejected the allegations, arguing that investigators had identified addresses compromised during the July 2025 attack. He suggested that hackers were reusing abandoned wallets, making the reported breach appear misleading.</p><br>
 <p>Meanwhile, blockchain investigator ZachXBT challenged that explanation by identifying deposit addresses that remained operational following the earlier security incident.</p><br>
 <p><a href="https://x.com/zachxbt/status/2113264816546873716" rel="noopener noreferrer nofollow">According to ZachXBT</a>, one address handled liquidity provider activity for approximately ten months following the July 2025 breach. Records also showed deposit transfers reaching CoinDCX’s active hot wallet during April and May 2026. Following these findings, Gupta acknowledged that the exchange was investigating further and assured customers they would not suffer losses.</p><br>
 <div class="embed-x">
  <blockquote class="twitter-tweet">
   <p>Withdraw all funds from CoinDCX if you value your assets.</p><br>
   <p>Its co-founders are clowns running a circus.</p><br>
   <p>They publicly and privately denied a theft of its assets occurred meaning they straight up lied or are negligently incompetent.</p><br>
   <p>Later they disclosed the $16M theft and… <a href="https://t.co/uEmtogPonq" rel="noopener noreferrer nofollow">pic.twitter.com/uEmtogPonq</a></p><br>
   <p>— ZachXBT (@zachxbt) <a href="https://x.com/zachxbt/status/2113264816546873716?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 22, 2026</a></p><br>
  </blockquote>
 </div>
 <h2 id="previous-44-million-hack-raises-questions-over-wallet-security">Previous $44 Million Hack Raises Questions Over Wallet Security</h2>
 <p>CoinDCX’s latest security incident follows a July 2025 attack that resulted in approximately $44 million in losses. Authorities subsequently linked that breach to malware installed on an employee’s company laptop following a fraudulent recruitment approach.</p><br>
 <p>Additionally, Indian authorities arrested Gupta and co-founder Neeraj Khandelwal in March following a separate fraud complaint. CoinDCX attributed that case to scammers operating an imitation website rather than misconduct involving its exchange.</p><br>
 <p>The company also attracted investment from <a href="https://36crypto.com/coinbase-rumored-to-buy-coindcx-after-44m-hack-slashes-valuation/" rel="noopener noreferrer nofollow">Coinbase</a> in October 2025, with the transaction valuing CoinDCX at approximately $2.45 billion.</p><br>
 <h2 id="coindcx-maintains-normal-operations-following-security-breach">CoinDCX Maintains Normal Operations Following Security Breach</h2>
 <p>CoinDCX confirmed that trading, deposits, and withdrawals remained operational despite the latest security incident. The exchange emphasized that its company reserves covered the losses, leaving customer balances unaffected.</p><br>
 <p>Meanwhile, ZachXBT criticized the company’s initial response and urged customers to withdraw their assets over concerns about its disclosures. He also reported helping the exchange freeze stolen cryptocurrency worth hundreds of thousands of dollars.</p><br>
 <p>CoinDCX’s admission establishes a second major security incident involving its infrastructure since July 2025, bringing combined reported losses to approximately $60 million.</p><br>
 <p><strong>Also Read: </strong><a href="https://36crypto.com/xrp-death-cross-confirmed-as-price-falls-to-1-30-with-1-25-support-under-threat/" rel="noopener noreferrer nofollow">XRP Death Cross Confirmed as Price Falls to $1.30, With $1.25 Support Under Threat</a></p><br>
</div>
<p>The post <a rel="noopener noreferrer nofollow" href="https://36crypto.com/coindcx-confirms-16-million-crypto-hack-after-initially-dismissing-breach-reports/">CoinDCX Confirms $16 Million Crypto Hack After Initially Dismissing Breach Reports</a> appeared first on <a rel="noopener noreferrer nofollow" href="https://36crypto.com">36Crypto</a>.</p>

CoinDCX Confirms $16 Million Crypto Hack After Initially Dismissing Breach Reports

Table of Contents

36crypto

Other articles published on Oct 26, 2026

Join our free newsletter for daily crypto updates!