CoinDCX absorbs $16 million loss tied to retired crypto wallet process failure

Traders Union
All News
Crypto
CoinDCX $16M wallet loss

Highlights

CoinDCX incurred a 15.99 million USDT loss after a failed process allowed customer deposits to accumulate in a deprecated wallet address.
The loss is tied to continued usage of addresses retired after the July 2025 $44 million hack, with affected funds credited to customer portfolios despite deprecation.
CoinDCX claims all user funds are safe and fully accounted for, but the incident heightens scrutiny of wallet management and disclosure practices among Indian crypto exchanges.

Operational failure linked to deprecated wallet addresses

As reported by CoinDesk, citing CoinDCX in a blog post published on Sunday, the loss stems from a service designed to sweep customer deposits from deprecated wallet addresses into the exchange's primary wallet. The company says some users continued sending funds to retired addresses after they were deprecated following the 2025 security breach, and those deposits were still credited to user portfolios when received.

CoinDCX says the sweeping process failed for a period, allowing funds to accumulate in one deprecated address tied to its old wallet infrastructure. The exchange says this resulted in a loss of 15.99 million USDT, which it is absorbing on its own balance sheet.

The company says it noticed unusual activity in its systems on Oct. 21, and identified irregular fund movement the following day through blockchain data and user reports. CoinDCX does not describe the incident as a hack in its blog post, and it does not identify who was behind the fund movement or explain how it occurred.

Disclosure questions and impact on the exchange

Earlier reports of suspicious outflows had been publicly dismissed by the exchange, with CEO Sumit Gupta calling them a false alarm on X. CoinDCX later acknowledged that at least some of the flagged activity involved an old address still receiving user deposits, despite its deprecated status.

The episode follows the exchange's July 2025 hack, which cost about $44 million and led CoinDCX to retire affected addresses from its operational setup. Blockchain investigator ZachXBT had said one of the addresses cited in the latest outflows was still being used by a liquidity provider and had swept user deposits to CoinDCX's current public hot wallet as recently as April and May 2026.

CoinDCX says all user funds remain safe in segregated cold wallets protected by offline and multilayer custody controls. While the company says customer crypto deposit balances are fully accounted for, the incident adds to scrutiny of wallet management and disclosure practices in India's crypto exchange sector.

Our earlier coverage of CTOS Digital’s cybersecurity incident explained how the breach and resulting service disruptions were expected to hit the company’s financials, with estimates pointing to lower profit and revenue if outages persisted into late October. We also noted that analysts warned recovery could take longer than a simple service restoration, as customer confidence, retention risks, and higher cybersecurity costs could continue to weigh on performance.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.