Indian cryptocurrency exchange CoinDCX has confirmed a $15.99 million loss involving wallet addresses compromised during its July 2025 security breach. According to the company, an operational failure allowed customer deposits to pile up in outdated wallets, leaving the funds exposed to additional losses.

In a statement issued on October 25, the exchange said it would absorb the entire loss, adding that customer funds remain protected and that its active trading infrastructure was unaffected.

Automated Sweeping Failure Behind the $15.99 Million Loss

CoinDCX decommissioned its old wallet infrastructure after the July 2025 cyberattack, yet some customers kept sending cryptocurrency to the retired addresses despite instructions to use updated deposit information.

To shield these customers from harm, the exchange ran an automated sweeping service designed to move deposits from retired addresses into secure wallets. That system failed for an unspecified period, allowing funds to accumulate on the compromised infrastructure. The company has not disclosed how long the failure lasted or what caused it.

Because confirmed blockchain transfers cannot be reversed, customers who send funds to a retired address depend entirely on the operator to recover them, which is the gap such sweeping systems are meant to close.

The company detected unusual activity on October 21 and, the following day, began probing irregular blockchain transactions. Its investigation concluded that the sweeping failure had produced a loss of 15.99 million USDT, equivalent to roughly $15.99 million. USDT is a stablecoin pegged to the US dollar, so the token loss translates directly into the dollar figure.

CoinDCX said it covered the financial impact and credited the affected customer deposits, stressing that its current wallets, trading systems, and withdrawal services continued to operate normally.

On-Chain Investigators Challenge Earlier Statements

The disclosure came after blockchain investigators flagged suspicious transactions involving addresses previously tied to CoinDCX. On-chain investigator ZachXBT, a researcher known for tracing stolen cryptocurrency, questioned the exchange's initial explanation that the affected wallets were no longer operational, citing transaction activity suggesting that at least one compromised address kept interacting with CoinDCX infrastructure after the 2025 attack.

Co-founder Sumit Gupta initially dismissed suggestions of a fresh security breach. The exchange subsequently acknowledged the operational failure while maintaining that its active wallets had not been compromised.

Security Concerns After the 2025 Hack

The episode follows CoinDCX's July 2025 cyberattack, which caused roughly $44 million in losses from an internal operational account. The exchange said at the time that customer assets remained unaffected and pledged to cover the financial damage through company reserves. Taken together, the two 2025 incidents represent roughly $60 million in losses for the company.

The new disclosure underscores the risks tied to retired cryptocurrency deposit addresses and automated fund-management systems. Even after exchanges replace compromised infrastructure, deposits that continue arriving at older addresses can create additional exposure, since those endpoints sit outside the exchange's monitored security perimeter until swept.

CoinDCX has urged customers to verify deposit addresses through its official application or website before transferring cryptocurrency.