India's CoinDCX said it had absorbed a loss of $15.99 million after a failed internal process allowed customer deposits to pile up in a retired cryptocurrency wallet linked to the $44 million security breach the exchange suffered in July 2025.

According to the exchange, some users continued sending funds to the old deposit addresses despite instructions to use updated wallets. An automated service responsible for sweeping stray deposits into CoinDCX's primary wallets failed for an unspecified period, resulting in the loss. Sweeping services like the one that broke down are routine background plumbing for exchange treasury operations, and the episode shows how a single silent failure in that layer can turn leftover deposits into a direct hit to an operator's balance sheet.

The company stressed that live infrastructure was untouched, saying its active wallets, trading systems, and customer balances were unaffected and that user funds remained protected in segregated cold wallets. The distinction matters: the shortfall landed on the exchange's own books rather than in individual customer accounts.

The disclosure followed earlier denials of suspicious outflows flagged by blockchain investigators. On-chain investigator ZachXBT, who was among the first to flag the July 2025 breach, publicly questioned the exchange's account of activity involving the retired addresses. CoinDCX Chief Executive Sumit Gupta had initially described the reports as a false alarm.

CoinDCX, founded in 2018 by Sumit Gupta and Neeraj Khandelwal, ranks among India's largest cryptocurrency exchanges. In July 2025, roughly $44 million was drained from one of its internal accounts used for liquidity provisioning. At the time, the company said customer wallets were unaffected and that it would bear the loss from its own treasury. Taken together, the breach and the deposit-sweeping failure mean the exchange has now shouldered close to $60 million in losses across the two episodes.

The incident highlights the operational and security risks involved in managing legacy wallet infrastructure, even after addresses have been retired in the aftermath of a breach. Decommissioning exposed addresses is only part of the job after a major exploit; funds that keep arriving on retired endpoints still have to be caught and cleared, and CoinDCX's own disclosure shows the cost of missing that step. The exchange said it would strengthen monitoring and controls around its deprecated systems — so far its main concrete follow-up, given that it has not detailed how long the sweeping service was down.