On October 25, 2026, CoinDCX confirmed a loss of 15.99 million USDT after an automated transfer failure affected deposits sent to retired wallets. The Indian exchange said it absorbed the loss, per Grafa.
Key Takeaways
- The wallets were legacy wallet infrastructure linked to a security breach in July 2025, where, CoinDCX said, a failed sweeping service let credited deposits pile up, costing 15.99 million USDT, the Tether stablecoin.
- CEO Sumit Gupta initially denied a breach, describing reports of suspicious transfers as a possible “false alarm”.
- Blockchain investigator ZachXBT disputed CoinDCX’s account, according to Cryptowisser. His analysis of one affected address said it also swept deposits into CoinDCX’s current hot wallet as recently as April and May 2026.
- The exchange said customer balances remained accounted for in segregated cold wallets.
- By CoinLaw’s calculation, the single 15,819,002 USDT transfer is about 98.9% of the 15.99 million total.
CoinDCX credited deposits its sweeper never moved
CoinDCX said, that Customers continued sending deposits to the old addresses and received credit in their accounts. A separate automated service was meant to move those funds into a primary wallet.
When it failed, funds accumulated in the deprecated wallets.
Customer credits outran custody, and the shortfall became the company’s. CoinDCX’s statement, as quoted by CoinDesk, says This led to a loss of 15.99 million USDT which was absorbed by the company.
Transactions on the TRON network show 15.99 million USDT leaving 40 wallets on Oct. 21, according to TokenPost. The largest transfer totaled 15,819,002 USDT.
CoinDCX says it absorbed a 15.99 million USDT loss from deprecated wallet infrastructure after its automated sweeping service failed. The exchange says customer balances were unaffected and trading, deposits and withdrawals continued without interruption. @CoinDCX @smtgpt https://t.co/U9FRay5rJf
— CoinLaw (@coinlaw_io) October 26, 2026
Gupta said the addresses had been compromised during the July 2025 incident and suggested hackers were reusing them.
ZachXBT’s analysis, found one affected deposit address had remained in use by a liquidity provider for 10 months after the July 2025 incident. TokenPost’s on-chain reading adds that, on Oct. 21, some affected addresses also received deposits, conflicting with CoinDCX’s earlier assertion that the addresses had not been used since a 2025 incident.
The disclosure, counted
The suspicious activity was publicly flagged early Wednesday by Darcy.
Gupta rejected the findings, writing “Thanks for highlighting, but this is incorrect, and CoinDCX wallets are not breached.“
Later Wednesday, the exchange acknowledged that a temporary failure in its sweeping process had caused operational losses, which it had absorbed, but that statement did not disclose the amount lost.
The 15.99 million USDT figure arrived in a blog update early Sunday, after several days of public scrutiny.
The July 2025 breach behind the retired wallets
In July 2025, the exchange suffered a roughly $44 million exploit that Gupta initially attributed to a server breach. Bengaluru police later said attackers posing as recruiters persuaded a CoinDCX software engineer to install malware on a company laptop. Assuming USDT trades at parity with the dollar, the new loss equals about 36% of that exploit, and the two incidents total roughly $60 million in disclosed losses (CoinLaw calculation).
CoinLaw’s Takeaway
The core exposure was architectural. A deposit path that kept crediting customers on infrastructure linked to the July 2025 breach let credits outrun custody, so one stopped job became a company-funded loss of 15.99 million USDT. CoinDCX said its systems continued crediting customer accounts despite the transfer failure.
A denial, a partial admission with no figure, then a number days later echoes a July 2025 account that police later contradicted. Who moved the funds, how, and why addresses called retired still took deposits stay open.
