CoinDCX Reports $15.99M Loss Following Earlier Denials of a Security Breach

Publish Date: October 26, 2026
Updated Date: October 26, 2026

Indian cryptocurrency exchange CoinDCX has confirmed a loss of $15.99 million following unusual activity involving previously compromised wallet infrastructure. The announcement came days after the company’s leadership dismissed reports of suspicious cryptocurrency transfers as a false alarm, raising fresh questions about incident reporting, wallet management, and transparency in the digital asset industry.

In an update published on October 25, CoinDCX explained that deposits had continued to arrive at old wallet addresses affected by a security incident in July 2025. An automated process designed to transfer those deposits into the exchange’s primary wallets had failed for a period, allowing funds to accumulate in the vulnerable infrastructure.

CoinDCX said the resulting loss amounted to 15.99 million USDT, which the company would absorb. It also maintained that customers’ balances remained accounted for and that its active wallets and trading systems had not been affected.

The disclosure has renewed discussion about the security responsibilities of cryptocurrency exchanges, particularly when legacy wallet addresses remain accessible after a major incident.

CoinDCX Confirms $15.99 Million Loss

CoinDCX’s latest statement clarified the circumstances behind suspicious transactions reported by blockchain investigators earlier in the week.

The company said it detected unusual activity in its systems on October 21, 2026. Further investigation and blockchain monitoring subsequently revealed irregular movements involving its old operational wallet infrastructure.

According to the exchange, the affected infrastructure had been compromised during the July 2025 security incident and was subsequently deprecated. However, some users continued sending cryptocurrency to those older addresses instead of using the updated deposit addresses available through the platform.

CoinDCX operated a process to move such deposits from the old addresses into its primary wallets. The exchange said this automated sweeping process failed for a particular period, allowing deposits to accumulate in the deprecated infrastructure.

The company confirmed that the incident resulted in a loss of 15.99 million USDT, approximately $15.99 million at the time of reporting.

Importantly, CoinDCX described the loss as one absorbed by the company rather than a loss deducted from customers’ account balances. The exchange stated that affected deposits had been credited to users’ portfolios and that customer funds remained accounted for.

Why CoinDCX Initially Denied a Security Breach

The confirmation followed public disagreement between CoinDCX and blockchain investigators over the source and significance of the suspicious transactions.

On October 21, blockchain observers flagged transfers involving approximately 15.99 million USDT and 5,783.81 TRX from wallets associated with CoinDCX. The funds were reportedly transferred to another address and subsequently distributed across multiple destinations, including addresses linked to major cryptocurrency exchanges.

CoinDCX initially rejected claims that its current wallet infrastructure had suffered another breach. Co-founder and CEO Sumit Gupta said the addresses involved were associated with the July 2025 incident and suggested that the latest activity could involve the reuse of previously compromised addresses.

The exchange also stated that the addresses in question had been deprecated and were not part of its current wallet network.

However, blockchain investigator ZachXBT challenged this explanation. He argued that at least one address had continued to receive deposits connected to CoinDCX operations after the 2025 incident, with activity reportedly extending into 2026.

Following further investigation, CoinDCX acknowledged that its sweeping process had failed and that funds had accumulated in the vulnerable legacy infrastructure.

The subsequent disclosure established that a financial loss had occurred, although the company’s explanation focused on the failure involving deprecated wallets rather than confirming a new compromise of its active wallet infrastructure.

What Happened to the 15.99 Million USDT?

The incident involved a process CoinDCX used to handle deposits sent to old wallet addresses.

According to the exchange’s explanation, the process involved two separate steps.

1. Crediting Deposits to Customer Accounts

When cryptocurrency arrived at a deprecated address, CoinDCX said it credited the corresponding amount to the user’s portfolio.

This meant the customer’s account balance could reflect the deposit even though the cryptocurrency had not yet been transferred to the exchange’s primary wallet infrastructure.

2. Moving Funds Through an Automated Sweeping Service

A separate service was responsible for transferring the deposited cryptocurrency from the old address into the primary CoinDCX wallet.

The exchange said this service stopped working for a particular period. As a result, deposits accumulated at the deprecated address rather than being moved into the intended secure infrastructure.

The old wallets had previously been compromised, creating a security risk if funds continued to arrive there.

CoinDCX said the loss occurred within this legacy arrangement and that the company absorbed the financial impact. Its public statement did not identify the individual or group responsible for the irregular fund movement or fully explain how the funds were taken.

CoinDCX Says Customer Funds Remain Safe

Following the disclosure, CoinDCX reiterated that its active wallets and trading systems continued operating without interruption.

The exchange said customer deposits remained accounted for and that its current custody arrangements used segregated cold wallets, multiple security layers, and offline controls.

It also stated that trading, deposits, and withdrawals continued during the period under review.

These assurances are important because the reported loss does not necessarily mean that every CoinDCX customer lost cryptocurrency. The company maintains that the financial impact was absorbed by the exchange and that active wallet infrastructure was not affected.

Nevertheless, the incident raises questions about the handling of deposits sent to outdated addresses and the effectiveness of controls designed to detect failures in automated wallet processes.

Customers should consult official CoinDCX communications for account-specific information and verify deposit addresses through the platform before transferring cryptocurrency.

Background: CoinDCX’s $44 Million Security Incident in 2025

The latest loss follows a major security incident in July 2025, when CoinDCX reported that approximately $44 million in cryptocurrency had been stolen.

The earlier incident involved an internal operational account used for liquidity-related activities. CoinDCX said at the time that the loss affected company treasury funds rather than customer balances.

Investigations into the 2025 incident also drew attention to the risks associated with compromised internal systems and operational access.

The exchange subsequently retired the affected wallet infrastructure. However, the October 2026 disclosure shows that decommissioning a wallet system does not necessarily eliminate all associated risks if old addresses continue receiving deposits and automated processes remain responsible for handling those funds.

The latest loss is smaller than the 2025 incident, but it highlights a different operational concern: how an exchange manages legacy infrastructure after a security compromise.

It also demonstrates why security reviews must extend beyond active wallets to include outdated addresses, automated transfers, monitoring systems, and procedures for handling deposits that arrive at deprecated locations.

What the Incident Means for Cryptocurrency Exchange Security

The CoinDCX disclosure offers several lessons for cryptocurrency exchanges and their customers.

Legacy Wallets Require Continuous Monitoring

Retiring a wallet infrastructure does not make every address associated with it harmless. Users may continue sending funds to previously issued addresses, intentionally or by mistake.

Exchanges need clear procedures for identifying deposits to old addresses, monitoring their status, and preventing funds from accumulating in systems with known security weaknesses.

Automated Processes Need Failure Alerts

Automated wallet sweeping can simplify the movement of funds between addresses, but a failed process can create significant operational exposure.

Exchanges should implement monitoring that detects missed transfers, unexpected balances, and prolonged service interruptions. Alerts and escalation procedures can help ensure that a technical failure does not remain unnoticed.

Communication Should Be Clear and Timely

CoinDCX’s initial denial and subsequent confirmation created confusion about the status of the reported transactions.

The company later acknowledged that it could have communicated more proactively while investigating the incident. This highlights the importance of distinguishing between what has been verified, what remains under investigation, and what is known about potential customer impact.

Clear communication can help users make informed decisions while an investigation is ongoing.

Customer Protection Depends on More Than Cold Storage

Cold wallets are an important security measure because they keep private keys offline. However, an exchange’s overall security also depends on deposit handling, wallet administration, internal permissions, monitoring, and the management of legacy infrastructure.

The incident illustrates that strong custody controls must be supported by reliable operational processes throughout the platform.

How Crypto Users Can Protect Their Funds

Although the reported loss was attributed to a process involving CoinDCX’s old wallet infrastructure, users can take practical steps to reduce avoidable risks when transferring cryptocurrency.

• Verify deposit addresses: Always obtain the latest address from the official exchange app or website before making a transfer.
• Avoid reusing saved addresses: Previously used deposit addresses may be outdated or unsupported. Confirm the address every time.
• Check official announcements: Follow verified communications from the exchange when a security incident or wallet update is reported.
• Understand custody risks: Cryptocurrency held on an exchange is subject to the platform’s security controls, operating procedures, and withdrawal policies.
• Consider self-custody carefully: A personal wallet gives users greater control over their private keys but also makes them responsible for backups, recovery phrases, and transaction security.
• Test transfers where appropriate: For supported networks, a small test transaction may help confirm that the address and network are correct before transferring a larger amount.

No security measure eliminates every risk, but careful address verification and a clear understanding of custody arrangements can help prevent avoidable losses.

What Happens Next for CoinDCX?

CoinDCX has said it will strengthen monitoring and controls around residual systems and improve reminders encouraging customers to update outdated deposit addresses.

The exchange has also maintained that its active infrastructure remains secure and that customer balances are unaffected by the reported loss.

The key questions moving forward concern how the sweeping failure occurred, how long it remained undetected, what additional safeguards will be introduced, and whether further details will emerge about the movement of the missing funds.

Greater transparency around those issues could help customers and the wider cryptocurrency industry better understand the incident.

For now, the company’s published explanation establishes that a $15.99 million loss occurred within its legacy wallet arrangement. It does not, by itself, establish the identity of the party responsible for the irregular movements or confirm a new breach of the exchange’s active wallets.

Final Thoughts

CoinDCX’s confirmation of a $15.99 million loss has renewed scrutiny of its wallet management and incident-response procedures. The disclosure followed earlier denials of a fresh breach and revealed that deposits had continued to accumulate in old, compromised addresses after an automated sweeping process failed.

The exchange says it will absorb the loss and that customer balances, active wallets, and trading operations remain unaffected. However, the incident highlights the importance of monitoring legacy infrastructure, maintaining reliable automated controls, and communicating security developments clearly.

For cryptocurrency users, the practical lesson is straightforward: verify deposit addresses through official channels and remain informed about changes to an exchange’s wallet systems. For exchanges, the incident reinforces the need to treat legacy infrastructure as a continuing security responsibility rather than a risk that disappears when a system is retired.

CoinDCX security incident, CoinDCX wallet loss, crypto exchange security, CoinDCX hack news, cryptocurrency wallet safety.