CoinDCX Absorbs $16 Million Loss After Retired Wallet Process Failure

CoinDCX, India’s largest crypto exchange by trading volume, says it has absorbed a loss of about $16 million caused by an internal process failure tied to a retired wallet. The issue began last week when blockchain sleuths flagged roughly $16 million in suspicious outflows from wallets linked to the Mumbai-based exchange. CEO Sumit Gupta quickly called it a false alarm on X, and a spokesperson said the addresses were old ones created in January 2025 and compromised in the July 2025 hack, which cost the exchange around $44 million. The exchange said it had not used them since.

ZachXBT Challenges the Exchange’s Denial

On-chain investigator ZachXBT disagreed, saying at least one of the addresses, labeled TQKJQ, was used by a liquidity provider and swept user deposits to CoinDCX’s current public hot wallet as recently as April and May 2026.

What Went Wrong With the Deprecated Wallet

In a blog post on Sunday, CoinDCX confirmed the wallet belonged to its old operational infrastructure, which was compromised in the July 19, 2025 incident and retired afterward. Some users kept depositing funds into those retired addresses, and the exchange credited their portfolios as soon as the money arrived. A secondary sweeping service was supposed to move those funds into the main wallet, but it failed for a period, so deposits piled up in the old address. The company said this led to a loss of 15.99 million USDT, which it absorbed. The post does not call the event a hack and does not say who moved the funds or how.

Customer Funds and Exchange Response

CoinDCX stressed that all user funds remain safe in segregated cold wallets with multi layer custody and offline security controls. It admitted the review of the old infrastructure took time and that it could have been more proactive, but said it shared the update once it had the full picture.