Indian cryptocurrency exchange CoinDCX has confirmed a loss of 15.99 million USDT after funds accumulated in wallet infrastructure that the company had retired following a security breach in July 2025.

The exchange said an automated sweeping service malfunctioned, allowing deposits sent to old addresses to remain there and later be lost. CoinDCX said the loss was covered by the company and did not affect customer balances, withdrawals, active trading systems or the exchange’s existing wallets.

CoinDCX said it detected unusual transactions on October 21 through blockchain monitoring and community reports. Its investigation found that the activity involved old operating wallet infrastructure affected by the July 2025 incident. A backend service designed to sweep incoming deposits from those addresses into CoinDCX’s secure wallets had gone offline for a period, causing funds to accumulate in the old wallets. The detection path also showed that outside on-chain observers were still tracking the retired addresses even after the exchange had moved them out of active use.

The company said trading, deposits and withdrawals continued normally. It also said user assets remained held in segregated cold-wallet custody.

CoinDCX provided further details in its official update: On-chain wallet activity update.

Old deposit addresses continued receiving funds

CoinDCX said some users continued sending cryptocurrency to older deposit addresses despite notices instructing them to update their deposit details.

The exchange described its recovery process as having two stages. When funds were sent to an old wallet, the user was credited, after which an automated service transferred the assets to CoinDCX’s main secure wallets. The incident demonstrated the risks of maintaining access to previously compromised wallet infrastructure: if the sweeping process stops, deposits can remain in addresses with a known security exposure.

On-chain data raised questions about the wallet status

Blockchain researchers questioned how the less active wallets were being used. According to Bitquery, one address held approximately $15.82 million in USDT, while 15.99 million USDT was tracked across 40 Tron wallets associated with CoinDCX. Bitquery’s investigation indicated that the activity was related to routine deposits through the day of the incident.

Approximately $9.63 million was also traced over about 18 hours to addresses linked to Binance, OKX and Gate. CoinDCX has not publicly explained how an unauthorized party unlocked or moved the funds. That missing explanation remains the most significant open question in the incident, and any further disclosure from the exchange is the immediate detail to watch.

The confirmation came days after CoinDCX CEO Sumit Gupta challenged initial reports about the breach. The flagged addresses belonged to infrastructure compromised in 2025, and Gupta had described concerns about the newly identified addresses as a “false alarm.” CoinDCX has since acknowledged that it continued interacting with those addresses because they were still processing its deposits. The reversal underscores the gap that can exist between an initial on-chain alert and a company’s confirmed account of an incident.