Indian cryptocurrency exchange CoinDCX has confirmed a loss of 15.99 million USDT, approximately USD 16 million, after an internal transfer mechanism failed to move deposits from a discontinued wallet. The company says it will cover the entire amount without affecting customer balances.
How the USD 16 Million Loss Occurred
CoinDCX’s official statement mentioned that the affected address belonged to infrastructure retired following a July 2025 security breach that reportedly cost approximately USD 44 million.
Despite the wallet’s retirement, certain customers continued transferring cryptocurrencies to its address. CoinDCX automatically credited those deposits to customer accounts, while a separate system was responsible for moving the assets into operational wallets.
This transfer mechanism, known as sweeping, stopped functioning during an unspecified period. Consequently, funds remained in the discontinued wallet instead of reaching the exchange’s active infrastructure. “This led to a loss of 15.99 million USDT, which was absorbed by the company,” CoinDCX stated.
Blockchain Investigators Question Earlier Denials
The disclosure followed reports of suspicious cryptocurrency transfers from addresses associated with CoinDCX. According to CoinDesk, CEO Sumit Gupta initially dismissed concerns about the transfers as a false alarm.
However, blockchain investigator ZachXBT disputed suggestions that the addresses were completely inactive. He identified an address labeled TQKJQ that had reportedly processed deposits and transferred funds to CoinDCX’s current hot wallet during April and May 2026. The exchange subsequently acknowledged that deposits had continued reaching its retired infrastructure.
Customer Funds and Security Concerns
CoinDCX reported detecting unusual activity on October 21, followed by irregular fund movements identified through blockchain monitoring and customer reports. The company has not identified the party responsible for the transfers or explicitly classified the incident as another hack.
“We want to reiterate that all user funds remain safe in secure, segregated cold wallets,” CoinDCX stated. The exchange also acknowledged delays in communicating its findings. The incident highlights operational risks associated with legacy cryptocurrency addresses, particularly when automated transfers fail and previously compromised infrastructure continues receiving deposits.
Also Read: Ethereum Delays Glamsterdam Hoodi Upgrade Over Smart Contract Security Risks
Disclaimer : Crypto News India does not recommend that any cryptocurrency should be bought, sold, or held by you. Do conduct your own due diligence and consult your financial advisor before making any investment decisions.
