CoinDCX Confirms $16 Million Loss From Old Wallets Days After CEO Dismissed Breach Reports

Indian crypto exchange CoinDCX has confirmed that 15.99 million USDT, roughly $16 million, was taken from deposit wallets it had stopped using after last year’s hack. In a blog update posted early Sunday, the company said it spotted unusual activity on Tuesday that hit its old wallet infrastructure, which carried unknown weaknesses. An automated sweeping service that moves funds between wallets had failed for a period, so user deposits piled up at an address the exchange no longer watched. CoinDCX says it absorbed the loss, that user funds remain safe in segregated cold wallets, and that trading, deposits and withdrawals continued as normal.

How the Denials Fell Apart

Asset rescue firm FlashRescue’s co-founder Darcy first flagged the outflows on Wednesday, saying the money, along with 5,783.81 TRX, went to a single Tron address and was then split and sent to deposit addresses at Binance, OKX and Gate. CEO Sumit Gupta replied within hours that the claims were incorrect and sounded like a false alarm, and the company’s account called them misleading. Onchain analyst ZachXBT disagreed, saying one address was used by a liquidity provider for ten months after the July 2025 incident and swept user deposits as late as April and May 2026.

He urged customers to withdraw their funds and accused the founders of lying or being negligently incompetent, though he said he had helped freeze stolen crypto for the exchange. By Wednesday morning the company admitted the sweeping failure but gave no figure.

CoinDCX Security History and Past Incidents

The July 2025 hack cost about $44 million. Police in Bengaluru later said hackers posing as recruiters tricked an engineer into installing malware on a work laptop. In March, Indian police arrested Gupta and co-founder Neeraj Khandelwal over a fraud complaint, which the company says came from scammers copying its site. Coinbase invested in October 2025 at a reported $2.45 billion valuation. The company’s public relations representative pointed to the blog post and did not answer follow-up questions.