Indian cryptocurrency exchange CoinDCX has reported the loss of approximately 15.99 million USDT after funds were taken from an old wallet infrastructure that the company stopped using in 2025. CoinDCX said it would absorb the entire loss and that customers would not bear the cost.

The exchange said its active wallets and trading systems were not affected. Customer assets remain held in separate cold wallets, while trading, deposits and withdrawals continued without interruption. CoinDCX said customer crypto remain safe, unaffected and fully accounted for.

The incident also underscores a risk that extends beyond the original breach: deprecated deposit addresses can remain live channels as long as users keep sending funds to them, and assets that accumulate there sit outside the exchange's primary secure wallet until they are swept.

How the CoinDCX Wallet Incident Happened

CoinDCX said it first detected unusual activity in its systems on October 21, 2026. The company said its existing controls prevented the incident from affecting its active wallets and trading systems.

Update on the on-chain Wallet Activity – 21st October 2026 Our full update on the recent on-chain activity, what happened, and what it means for you. User funds remain safe, and trading and withdrawals continue as usual. Read the full update: — CoinDCX (@CoinDCX) October 25, 2026

The following day, the exchange identified irregular fund movements in blockchain data and received related reports from users. A subsequent investigation found that the activity involved an old wallet setup containing previously unknown weaknesses.

The wallet infrastructure had been compromised during a security incident on July 19, 2025. CoinDCX said it discontinued use of that infrastructure after the breach. However, some users continued sending deposits to the old addresses rather than using the updated addresses displayed in the CoinDCX app.

The exchange said it continued processing those deposits so users would not lose access to their funds. Its deposit process involved two separate steps. First, funds were credited to a user’s account after arriving. A separate automated service then moved, or “swept,” those funds into the exchange’s primary secure wallet.

CoinDCX said the sweeping service failed for a period of time. Deposits therefore accumulated at the old address and were exposed when the subsequent activity occurred. The company has not disclosed the full method used to withdraw the funds from the wallet, nor has it identified the party responsible. Those open details remain central to whether any further funds can be traced.

CoinDCX’s October 25 update is available at CoinDCX’s official website, and the company’s announcement was also published on X.

Tether Freezes Part of the Funds

Reports published on October 24 and 25 said Tether had blacklisted wallets connected to the outflow. Tether, the issuer of USDT, can block wallets holding its token. Because that control operates at the token level, it can immobilize USDT even after funds have moved off an exchange's own infrastructure.

Blockchain analytics firm AMLBot said approximately $2.2 million had been frozen. That amount represents roughly 13.8% of CoinDCX’s reported loss. A freeze prevents the funds from moving, but does not establish that they have been recovered. CoinDCX would need to confirm any recovery, while the remaining funds still have to be traced.

CoinDCX said it operated for 72 hours without downtime, withdrawal limits or trading disruption. The company also acknowledged that it “could have been more proactive” in communicating the incident. It said it waited until it had a complete understanding of the situation before publishing an update.

The exchange said it plans to strengthen monitoring and controls around legacy systems. It will also issue regular reminders that old deposit addresses are retained only for a limited period. For readers following the case, the outstanding items are whether more of the remaining funds can be located or frozen, whether the undisclosed withdrawal method is ever made public, and whether CoinDCX confirms any recovery.

In its October 25 update, CoinDCX advised users to verify the most recent deposit address in the app or on the website before making every deposit. The exchange warned that sending funds to old addresses is highly risky and that exchanges generally do not assume responsibility for assets sent to them. The episode gives that warning a concrete shape: when the automated sweep stopped, deposits sent to deprecated addresses stayed at the old address and were exposed.

The original report was published by Blockonomi.