CoinDCX Admits $16M Crypto Loss After Investigator Flags Suspicious Transfers

Highlights:

• CoinDCX lost nearly $16 million after a system failure left crypto deposits in old, vulnerable wallets.
• Blockchain investigator Darcy first flagged the suspicious transfers, but CoinDCX initially dismissed concerns about another hack.
• CoinDCX says it will cover the $16 million loss and that customer funds and trading remain safe.

Indian cryptocurrency exchange CoinDCX has confirmed a loss of 15.99 million USDT, worth nearly $16 million, after funds built up in old wallet addresses exposed in a previous security breach. The confirmation follows an October 22 warning from a blockchain investigator that CoinDCX initially played down. The exchange says it has covered the loss and customer balances remain safe.

In an October 25 official update, CoinDCX said it first noticed unusual activity on October 21. It later found that a system designed to move deposits out of its retired wallets had stopped working for a period. The company did not say how long the failure lasted.

Update on the on-chain Wallet Activity – 21st October 2026
Our full update on the recent on-chain activity, what happened, and what it means for you.
User funds remain safe, and trading and withdrawals continue as usual.
Read the full update: https://t.co/fSr10QlkJh

— CoinDCX (@CoinDCX) October 25, 2026

Investigator Darcy Flags Nearly $16 Million in Transfers

Blockchain investigator Darcy, co-founder of crypto asset recovery service FlashRescue, publicly flagged the transfers on October 22. Darcy reported that about 15.99 million USDT and 5,783.81 TRX had moved from CoinDCX-linked addresses on the TRON network the previous day.

One transaction accounted for 15,819,002 USDT. Darcy said the funds reached another wallet before being split among several addresses. Some were then sent to deposit addresses associated with Binance, OKX and Gate. The transfers raised questions about whether CoinDCX had suffered another security breach.

10 月 21 日 23:35:54（UTC+8），CoinDCX 疑似被盗取约1,599 万 USDT 和 5,783.81 TRX

CoinDCX 热钱包及多个充值地址，向 TRON 地址 TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT 转入约 1,599 万 USDT 和 5,783.81 TRX

其中最大单笔为 15,819,002…

— Darcy 资产救援⛑️ (@DarcyAri) October 22, 2026

CoinDCX co-founder and CEO Sumit Gupta rejected that suggestion in his initial response. He said the flagged addresses belonged to old infrastructure compromised in July 2025, rather than the exchange’s active wallets. He also suggested hackers could be reusing those addresses and called the warning a possible “false alarm.”

Blockchain investigator ZachXBT challenged the response. He claimed one of the addresses continued handling deposits after the 2025 breach and had interacted with CoinDCX’s current hot wallets as recently as April and May 2026. Later on October 22, CoinDCX acknowledged operational losses linked to its process for collecting deposits from old wallets. However, it did not disclose the amount until its October 25 update, when it confirmed the 15.99 million USDT figure.

Failed Wallet Transfer Process Left Deposits Exposed

CoinDCX said it retired the affected wallet system after its July 2025 security incident. Yet some customers continued sending cryptocurrency to those addresses, even though the exchange had asked them to use new deposit details.

CoinDCX used a two-step process to handle deposits sent to old wallets. First, it added the deposited amount to each customer’s account. Then, an automated system moved the cryptocurrency from the old wallets to the exchange’s secure wallets.

However, the automated system stopped working for an unknown period. As a result, deposits continued to build up in the old wallets, which still had security weaknesses. CoinDCX said the failure caused a $15.99 million loss, which it covered with its own funds. The exchange has not explained who took the money or how they accessed the wallets. It also has not said whether it recovered any of the missing funds.

CoinDCX Says Customer Funds and Trading Were Unaffected

The exchange said its active wallets, trading platform and customer balances were not affected. It reported no interruption to deposits, withdrawals or trading during the 72 hours before its October 25 statement. According to CoinDCX, customer assets remain in separate cold wallets, which keep crypto keys offline.

The company also admitted that it was its own fault for not communicating earlier. Investigators need time to review the retired system and determine the sequence of events, it said. CoinDCX is set to intensify its efforts in auditing the older systems and remind users once again not to put money into an old address. It is essential that customers verify the most recent address to make a transfer in the official application or website.

The incident follows a breach last July that compromised about $44 million in an account the company used for internal operations. At the time, CoinDCX said it covered the losses from its reserves and that customer assets were unaffected.