CoinDCX admits losing $15.99 million in USDT days after its CEO dismissed theft claims as a false alarm

CoinDCX has admitted losing 15.99 million USDT in an October 21 attack, three days after CEO Sumit Gupta dismissed the same flagged transfers as a possible false alarm.

The Indian exchange said a failed automated sweeping service left customer deposits sitting in old wallets from its July 2025 breach, where an attacker took them. It says it absorbed the loss and that customer balances are untouched.

Coindcx exploit disclosure reverses earlier denials

The admission followed several days of disagreement between the exchange’s leadership and blockchain investigators examining suspicious transfers on the Tron network.

On October 22, chief executive Sumit Gupta rejected suggestions of another security breach. He said the flagged addresses belonged to infrastructure compromised in July 2025 and maintained that no funds had moved from current operational wallets into those addresses.

Gupta suggested that the earlier attackers might have reused the compromised wallets, presenting the suspicious activity as a possible false alarm.

Blockchain investigator Darcy, however, had identified transactions involving approximately 15.99 million USDT and 5,783.81 TRX. The subsequent Coindcx exploit disclosure confirmed that customer deposits were still reaching the old addresses and that CoinDCX maintained a system to retrieve them.

The exchange said it noticed unusual activity on October 21 and identified irregular fund movements the following day through blockchain records and community reports.

“We could have been more proactive,” CoinDCX said in its statement, acknowledging shortcomings in its communication while explaining that establishing the sequence of events took time.

Failed wallet sweeping allowed deposits to accumulate

According to CoinDCX, some customers continued transferring cryptocurrency to previously issued deposit addresses despite instructions to use replacement wallets.

The exchange maintained a recovery process for those transfers. Customers received credit when their deposits arrived, while a separate automated service moved the underlying cryptocurrency into secure operational wallets.

That arrangement allowed customers to access their credited balances before the transfers between wallets were completed. The Coindcx exploit exposed a failure in this process: when the sweeping service stopped functioning, funds accumulated in an address associated with the compromised infrastructure.

CoinDCX has not disclosed when the service failed, how long deposits remained there or precisely how unauthorized parties gained control of the funds.

Blockchain investigator ZachXBT challenged the description of the wallets as retired, citing an address beginning TQKJQ. He alleged that a liquidity provider continued using it for roughly 10 months after the July 2025 breach, with transactions appearing as recently as April and May 2026.

Separate analysis by Bitquery traced routine deposit movements through affected addresses up to October 21. It identified 88 deposits totaling approximately 15.82 million USDT accumulating in one wallet.

Those findings sharpened questions surrounding the Coindcx exploit because they indicated continued transaction activity after the infrastructure had been classified as retired. Bitquery’s investigation did not establish how the attacker obtained the private keys.

Investigators trace transfers to exchange-linked addresses

Bitquery’s examination of Tron blockchain records indicated that the October 21 activity extended beyond a single wallet.

Its Coindcx exploit analysis identified 40 affected addresses and traced approximately $9.63 million through intermediary wallets to deposit addresses associated with OKX, Binance and Gate within 18 hours of the main transfer.

The reported destinations describe the movement of funds; they do not establish wrongdoing by the exchanges receiving those transfers.

Bitquery also reported that Tether froze approximately $2.21 million across nine wallets on October 22. CoinDCX’s October 25 statement did not disclose any asset recovery or identify the recipients of the missing funds.

The distinction matters when assessing the Coindcx exploit: funds reportedly frozen on-chain should not be treated as money recovered by the company.

The incident follows CoinDCX’s $44 million loss in July 2025, which it attributed to a sophisticated server compromise affecting an internal liquidity account. After that breach, the company restored normal trading and said segregated customer custody arrangements had protected users from losses.

Customer balances protected as regulatory questions remain

CoinDCX maintained that it covered the latest loss without reducing customer balances or restricting services.

“User funds remain safe, and trading and withdrawals continue as usual,” CoinDCX said in its October 25 update on X.

The Coindcx exploit also raises questions about incident reporting. CoinDCX is registered with India’s Financial Intelligence Unit as a reporting entity subject to anti-money laundering and counterterrorist financing requirements.

However, its disclosure did not say whether it had notified FIU-India, CERT-In or another Indian authority. The supplied reporting identified no confirmed regulatory investigation or enforcement action concerning the October 21 transfers.

CoinDCX said it would strengthen monitoring of older wallet systems and remind customers that support for retired deposit addresses is temporary. It also advised users to verify their current deposit addresses before transferring cryptocurrency.

While the exchange says customers were shielded from the financial loss, its account of the Coindcx exploit still leaves the duration of the sweeping failure and the precise mechanism of the theft unexplained.