CoinDCX Confirms $16 Million Loss Days After Saying It Wasn't Breached

CoinDCX says it lost 15.99 million USDT, about $16 million, from old wallets it retired after a 2025 security incident. The Indian exchange put a number on it in a blog post early Sunday and said the company absorbed the loss.

Wednesday's message was different. Hours after the funds moved, co-founder and CEO Sumit Gupta wrote on X that "CoinDCX wallets are not breached" and asked people not to spread rumours.

A failed sweep left deposits in a retired address

CoinDCX said it spotted unusual activity on Oct. 21. The next day, blockchain data and user reports showed money leaving its deprecated wallet setup, which the exchange said "had unknown vulnerabilities."

Some users had kept sending deposits to those old addresses. CoinDCX credits those deposits to customer accounts right away, and a separate service later sweeps the coins into its main wallet. That service "had failed for a particular period," the post said, so the USDT piled up where it could be taken.

On-chain investigator ZachXBT had publicly challenged the exchange's first account, The Block reported.

What customers are told

CoinDCX said deposit balances are fully accounted for, customer funds sit in segregated cold wallets, and trading, deposits and withdrawals ran without a pause. "We could have been more proactive," it wrote.

The exchange now tells users to check the current deposit address in its app before every transfer.

In our opinion: Retired deposit addresses are a quiet risk at any exchange. Warning users off them helps, but the backend that watches them has to keep working too.