The prominent Indian digital asset platform reported that customer funds accumulated inside legacy, vulnerable addresses impacted by its July 2025 security breach after an automated protocol meant to transfer those balances malfunctioned.
Indian cryptocurrency platform CoinDCX acknowledged that it suffered a theft of 15.99 million USDT, equivalent to approximately $16 million, during an incident targeting deposit wallets it abandoned after a previous exploit in 2025. This clarification follows statements made only days prior by the firm’s co-founder and CEO, Sumit Gupta, who assured community members on X that rumors of a security breach were merely “a false alarm.”
In an update published on its corporate blog early Sunday, CoinDCX stated it detected abnormal transactions on Tuesday that “had impacted our old, deprecated wallet infrastructure which had unknown vulnerabilities.” The exchange explained that its automated transfer utility, designed to route capital between platform wallets, “had failed for a particular period,” causing user deposits to pile up at an address the company had discarded. “This led to a loss of 15.99 million USDT which was absorbed by the company,” CoinDCX noted.
“We want to reiterate that all user funds remain safe in secure, segregated cold wallets, protected by multi-layer custody and offline security controls,” CoinDCX wrote, adding that standard trading, deposits, and withdrawals continued normally despite the security event.
Admission follows Wednesday’s denials
Unusual fund removals from CoinDCX wallets were initially highlighted at 1:30 a.m. ET on Wednesday by Darcy, the co-founder of asset recovery service provider FlashRescue, who shared that nearly 15.99 million USDT and 5,783.81 TRX departed CoinDCX’s hot wallet alongside a collection of deposit endpoints at 11:35 a.m. ET on Tuesday. The entirety of the capital moved to a single Tron destination. The largest single transaction totaled 15,819,002 USDT, after which the assets were divided and channeled to deposit destinations at Binance, OKX, and Gate, according to Darcy.
Gupta responded to Darcy’s message under three hours afterward. “Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached,” he posted, asserting that the relevant addresses had been compromised during the July 2025 event and that “the hackers seem to be re-using the old wallet addresses and this sounds like a false alarm.”
The official CoinDCX account echoed this position four minutes later, labeling the allegations “misleading” and maintaining that the endpoints “have not been used by CoinDCX since” the July 2025 occurrence.
Blockchain investigator ZachXBT subsequently challenged CoinDCX’s denials. One particular deposit address, he stated, “was in use by a [liquidity provider] for 10 months after your July 2025 incident” and that same endpoint swept customer deposits into CoinDCX’s active hot wallet as recently as April and May 2026. “Meaning $15.8M in user deposits was unaccounted for by your team,” he pointed out.
Gupta replied to ZachXBT at 5:59 a.m. ET, stating the crew was “investigating it further” and that “no user funds will be at loss.” By 7:47 a.m. ET, CoinDCX announced that its asset sweeping mechanism malfunctioned “for a particular period” and that this “led to some operational losses, which were absorbed by CoinDCX.” That statement did not specify a monetary figure for the losses.
ZachXBT subsequently urged participants to “withdraw all funds from CoinDCX if you value your assets.” He claimed that the enterprise’s leaders “publicly and privately denied a theft of its assets occurred meaning they straight up lied or are negligently incompetent,” though he mentioned he had still assisted in freezing stolen digital assets worth hundreds of thousands of dollars on behalf of the organization.
$16M loss adds to prior incidents
The July 2025 security breach cost CoinDCX approximately $44 million, an event Gupta previously attributed to a server breach. Bengaluru law enforcement later indicated that malicious actors posing as employment recruiters had tricked a CoinDCX developer into downloading malicious software onto an enterprise laptop, granting the attackers entry to internal network infrastructure.
Onchain drains and social engineering schemes are not the sole challenges encountered by CoinDCX. Indian authorities detained Gupta and co-founder Neeraj Khandelwal in March regarding a fraud allegation, which CoinDCX stated originated from fraudsters mimicking the business via a fraudulent replica website.
Coinbase put capital into CoinDCX in October 2025 through an agreement that Gupta stated gave the platform a $2.45 billion valuation, expanding the U.S.-based exchange’s footprint across India and the Middle East.
When questioned about Gupta’s prior remarks and ZachXBT’s assertions, a spokesperson for CoinDCX’s public relations firm directed The Block toward the organization’s blog post while declining to comment on specific follow-up inquiries.
Originally published at https://www.theblock.co/news/business/2026-10-25-coindcx-confirms-16-million-loss-from-retired-wallets-days-after-ceo-called-breach-reports-a-false-alarm-431617.
