CoinDCX Confirms $16 Million Loss Days After CEO Called Breach Reports a ‘False Alarm’
Key Takeaways
- •CoinDCX confirmed losing 15.99 million USDT, approximately $16 million, from wallet addresses it had retired following a hack in July 2025.
- •The CEO had initially described the suspicious on-chain activity as a false alarm before the company disclosed the theft and said it absorbed the loss.
- •The funds moved on the Tron network on Oct. 21 after an automated system failed to transfer residual customer deposits from the retired addresses to active wallets.
- •Combined with the roughly $44 million server breach in July 2025, the exchange's cumulative losses from the two incidents approach $60 million.
- •On-chain investigator ZachXBT publicly disputed the exchange's initial denial and urged users to withdraw their assets, while CoinDCX maintains that customer balances remain unaffected.
Indian crypto exchange CoinDCX has confirmed that it lost 15.99 million USDT, worth approximately $16 million, after an internal process failed to transfer customer deposits out of wallets that had been retired following a 2025 hack.
The disclosure reversed co-founder and CEO Sumit Gupta’s earlier statement that reports of a breach were a “false alarm.” CoinDCX said in an official blog post that the funds were drained from its wallet infrastructure and that the company had absorbed the loss. It reiterated that customer funds and balances remain safe.
The funds moved on the Tron network on Oct. 21. CoinDCX attributed the incident to a failure in an internal process designed to sweep residual customer deposits from wallets it had stopped using after a substantially larger hack last year. The retired addresses continued receiving deposits, while an automated transfer system failed to move those funds to the exchange’s active wallets. Because retired addresses remain live on public blockchains, deposits sent to them stay visible on-chain — the visibility that allowed blockchain researchers and the Arkham tracker to flag the outflows once the funds moved.
The disclosure followed several days of conflicting claims. After blockchain researchers and the Arkham tracker flagged approximately $16 million in suspicious outflows, Gupta wrote on X that CoinDCX’s wallets were “not breached.” He said the flagged addresses had been compromised in July 2025 and that the activity appeared to be “a false alarm.”
On-chain investigator ZachXBT disputed that explanation, saying the wallet had continued sweeping user deposits into CoinDCX’s current hot wallet as recently as April and May. He urged customers to withdraw their assets in a post on X:
Withdraw all funds from CoinDCX if you value your assets. Its co-founders are clowns running a circus. They publicly and privately denied a theft of its assets occurred meaning they straight up lied or are negligently incompetent. Later they disclosed the $16M theft and… pic.twitter.com/uEmtogPonq — ZachXBT (@zachxbt) October 22, 2026
The latest loss adds to a difficult period for one of India’s largest crypto exchanges. CoinDCX suffered a hack worth approximately $44 million in July 2025, which it attributed to a server breach. The incident led to a bounty effort for the recovery of the stolen funds and later to the arrest of an employee in connection with the attack.
Combined, the two incidents have caused losses of nearly $60 million. The wallets involved in the latest incident were a legacy of the earlier breach: CoinDCX had retired the addresses, but residual deposits continued to arrive there. The breakdown in the automated transfer process left those funds exposed.
CoinDCX has also faced other challenges this year. Allegations involving fraud and impersonation scams prompted a police investigation. Separately, the exchange’s founder denied reports that CoinDCX was in acquisition talks with Coinbase after the 2025 hack. Coinbase has independently taken steps to expand in South Asia and the Middle East.
CoinDCX said it would provide additional details as its investigation continues and repeated that user balances were unaffected. How the automated transfer failed, and why residual deposits kept arriving at addresses retired more than a year earlier, are among the questions the company has yet to answer.
