Indian crypto exchange CoinDCX has confirmed that 15.99 million USDT, worth about $16 million, was stolen from its wallet infrastructure after an internal process failed to remove customer deposits from wallets that had been retired following a previous hack.
The admission reverses an earlier statement from co-founder and CEO Sumit Gupta, who had described reports of a new breach as a “false alarm.” CoinDCX said it would absorb the loss and maintained that customer balances were not affected.
According to Decrypt, the funds were moved on the Tron network on October 21. The exchange said its investigation had identified a failure in an automated sweeping process. That system was intended to transfer deposits out of older wallet addresses and into active wallets, but the retired addresses continued receiving residual customer deposits.
The incident highlights how legacy wallet infrastructure can remain exposed even after an exchange stops using it for routine operations. In this case, the addresses had been retired after a substantially larger security incident in 2025, but the transfer process designed to clear them did not work as intended.
CEO’s earlier denial
Blockchain researchers and the Arkham tracking service had initially flagged approximately $16 million in suspicious outflows. Gupta rejected the breach reports on X, saying that CoinDCX wallets had not been breached and that the addresses involved had already been compromised in July 2025. He said that the activity had created what appeared to be a false alarm.
On-chain investigator ZachXBT challenged that explanation. He said the wallet in question had continued sweeping user deposits into CoinDCX’s current hot wallet as recently as April and May, and urged customers to withdraw their assets.
CoinDCX later acknowledged the theft and said it would provide more information as its investigation continues. The exchange repeated that user funds remain safe, while accepting responsibility for the loss.
Losses now approach $60 million
The newly disclosed theft adds to the roughly $44 million CoinDCX lost in a July 2025 hack. The exchange attributed that earlier incident to a server breach. It launched a bounty effort to recover the stolen assets, and an employee was later arrested in connection with the episode.
Taken together, the two incidents represent losses of nearly $60 million for the exchange. The latest event also adds to a difficult period for CoinDCX, which has faced allegations involving fraud and impersonation scams that led to a police investigation. Its founder has also denied reports that Coinbase was considering acquiring the company after the 2025 hack.
Market picture
Moneyiar market data recorded at 10:38 p.m. local time on October 25 shows Tether USDt, the stablecoin involved in the loss, at $0.9987425383, unchanged over 24 hours and down 0.01% over seven days.
The same data showed NEAR Protocol at $4.6166906773, up 3.36% in 24 hours but down 6.21% over seven days. Rain traded at $0.0084289407, gaining 2.54% in 24 hours and falling 8.14% over seven days, while BAS stood at $0.0169243841, down 1.24% over 24 hours and 7.19% over seven days.
