CoinDCX reports $15.99 million USDT loss from old wallets after disputing claims of a second breach
CoinDCX says a failed automated service left funds sitting in old addresses, leading to a loss of 15.99 million USDT on October 21. Days earlier, CEO Sumit Gupta had disputed claims of a second breach. He said the addresses in question were tied to the exchange’s July 2025 compromise, not its current operational wallets.
- CoinDCX’s explanation: Customers kept depositing to some old addresses, but a service meant to move those funds into secure wallets failed.
- Customer impact: CoinDCX says it absorbed the loss, leaving customer balances and services unaffected.
- Blockchain findings: Bitquery traced funds to exchange-associated deposit addresses and reported that Tether froze approximately $2.21 million.
- Still unresolved: When the service stopped working, how the funds were taken, and whether any were recovered.
How funds remained at old addresses
CoinDCX’s statement was dated October 25. The statement does not specify a year, but its linked page identifies 2026. The events described here are therefore dated to October 2026.
The exchange said some customers kept sending funds to deposit addresses tied to infrastructure it had replaced after a $44 million breach in July 2025. CoinDCX said it credited customers for those deposits and used an automated deposit-sweeping service to move the funds from old addresses into secure operational wallets.
According to CoinDCX, the service failed. The company has not said when it stopped working, how long funds remained at the old addresses, or how unauthorized parties gained control of them. Its explanation points to a failed transfer process, but does not establish whether the old addresses were still compromised from the July breach or whether someone exploited another weakness.
That distinction matters. A sweeping service moves funds, but it does not explain who could access them or how. The public account has yet to connect the service failure to the method used to steal the funds.
On October 22, Gupta rejected claims of a second breach. He said the flagged addresses were associated with the July 2025 compromise and that no funds had moved from current operational wallets into them. CoinDCX’s later statement clarified that customers were still sending deposits to some old addresses, and the exchange normally moved those funds onward.
CoinDCX said it noticed unusual activity on October 21. The following day, it identified irregular movements through blockchain records and community reports. The exchange acknowledged that it could have communicated sooner:
“We could have been more proactive, ”
Blockchain analysis traces some of the funds
Blockchain investigator Darcy identified transfers involving approximately 15.99 million USDT and 5, 783.81 TRX on the Tron network. The TRX figure is separate from the USDT loss. CoinDCX has not published a full accounting that reconciles all the identified movements.
Blockchain analysis firm Bitquery reported that 88 deposits totaling approximately 15.82 million USDT accumulated in one wallet. That is about 170, 000 USDT less than CoinDCX’s stated loss of 15.99 million USDT. These figures refer to different reported measures: CoinDCX’s loss and Bitquery’s deposits to one wallet. The available information does not explain the gap.
Bitquery also identified 40 affected addresses and traced approximately $9.63 million through intermediary wallets to deposit addresses associated with OKX, Binance, and Gate within 18 hours of the main transfer. An exchange-associated deposit address does not, by itself, show who controlled it or who ultimately received the funds.
Bitquery reported that Tether froze approximately $2.21 million across nine wallets on October 22. CoinDCX’s statement did not confirm how much, if any, was recovered or identify the recipients of the missing funds.
Questions over whether the addresses were truly retired
CoinDCX described the addresses as old infrastructure it had replaced after the July 2025 breach. Blockchain investigator ZachXBT questioned whether they had actually stopped being used. He pointed to an address beginning TQKJQ and alleged that a liquidity provider kept using it for roughly 10 months after the July breach, with transactions recorded as recently as April and May 2026.
The allegation raises a practical security question: how long should an exchange continue supporting a deposit address after retiring it, and what safeguards protect funds that still arrive there? CoinDCX said it would improve monitoring of older wallet systems and remind customers that support for retired deposit addresses is temporary. It also advised customers to check deposit addresses before transferring funds.
Deposit sweeping is a common way to consolidate funds sent to individual addresses. But it is only one part of wallet security. If an old address can still receive funds, the exchange needs safeguards to protect them when the usual transfer process fails.
What CoinDCX says about customer funds and reporting
CoinDCX says it absorbed the loss and that customer balances, active wallets, trading, deposits, and withdrawals were unaffected. The company also said segregated customer custody arrangements prevented user losses in the July 2025 breach, which it attributed to a sophisticated server compromise affecting an internal liquidity account. CoinDCX later said it had restored normal trading operations.
CoinDCX is registered with India’s Financial Intelligence Unit as a reporting entity subject to anti-money laundering and counterterrorist financing requirements. Its October 25 disclosure did not say whether it notified FIU-India, CERT-In, or another Indian authority. The public information available here does not establish whether the exchange made a notification or an inquiry took place.
Key questions and answers
-
What did CoinDCX lose?
CoinDCX confirmed a loss of 15.99 million USDT. Investigators also identified transfers involving 5, 783.81 TRX, a separate asset amount.
-
Why were funds at old addresses?
CoinDCX said customers continued depositing to some old addresses, but an automated service that normally moved those funds to secure wallets failed.
-
Did customers lose funds or access to services?
CoinDCX says it absorbed the loss and that customer balances, trading, deposits, and withdrawals were unaffected.
-
How much was frozen?
Bitquery reported that Tether froze approximately $2.21 million across nine wallets. CoinDCX has not confirmed a total recovery figure.
-
How did unauthorized parties gain access?
That remains unknown. CoinDCX has not explained how they gained access, and the available blockchain analysis did not establish how the relevant private keys were obtained.
-
Has CoinDCX disclosed any notification to Indian authorities?
No. Its public disclosure did not say whether it notified FIU-India, CERT-In, or another authority.
Customers should request or verify a current deposit address directly with CoinDCX rather than reuse an old one. For broader context on stablecoin pressures, see MiCA’s impact on USDT in Europe.
