CoinDCX has confirmed a loss of roughly $16 million after attackers drained deposit wallets the exchange thought it had put out to pasture. The company says it absorbed the hit itself.
The retired wallets were left over from the exchange’s 2025 hack. Wallets meant to be part of the cleanup ended up becoming a second chapter of the problem.
What went wrong at CoinDCX
The research findings put the outflow at approximately 15.99 million USDT, along with 5,784 TRX. The funds moved from 40 TRON addresses into a newly created address.
CoinDCX reported the loss on October 21, 2026. India’s largest crypto exchange described the damage as an operational loss rather than a hit to customer balances.
The culprit, according to the exchange, was its automated sweeping service. That system moves funds between CoinDCX’s own wallets, pulling deposits out of old addresses and into active ones.
CoinDCX said the service “had failed for a particular period.” During that window, user deposits kept arriving at an address the exchange was no longer using.
Users made whole, questions remain
The exchange says it credited affected users from internal reserves. It also said trading operations were not disrupted.
Tether stepped in after the outflow. On October 22, the stablecoin issuer froze approximately $2.21 million in USDT tied to the incident.
Still, a $2.21 million freeze against a loss of roughly $16 million leaves a sizable gap. CoinDCX is eating the bulk of the damage.
On-chain analysts complicated the official narrative. ZachXBT and Bitquery flagged that at least one of the TRON addresses in question had stayed active after it was labeled retired.
That address reportedly kept interacting with CoinDCX’s hot wallet for months after the 2025 hack.
The 2025 hack shadow
This is not CoinDCX’s first wallet problem. In July 2025, the exchange lost an estimated $44 million from an internal liquidity account in a hack.
CoinDCX has maintained that customer assets held in segregated cold storage were not affected.
The addresses at the center of the latest incident were the ones the exchange stopped using after that breach. Retiring compromised or suspect wallets is standard post-hack hygiene.
What this means for CoinDCX and its users
For CoinDCX customers, the immediate financial damage appears contained. The exchange says it credited affected users and absorbed the loss, and trading continued without interruption.
The gap between “retired” and “still active” is where the credibility damage lives. When independent analysts surface on-chain activity that cuts against a company’s framing, users tend to trust the blockchain over the press release.
The Tether freeze also reinforces a pattern worth watching. Stablecoin issuers increasingly act as a last line of recovery after exchange incidents.
The market reaction so far has been muted. The research findings note no immediate market-wide price impact on USDT or broader tokens, suggesting traders see this as a CoinDCX problem rather than a systemic one.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.