Indian cryptocurrency exchange CoinDCX has formally confirmed losing 15.99 million USDT after a failed automated deposit-sweeping process left customer deposits exposed in wallets compromised during a previous security breach.
In an October 25 disclosure, the company explained that customers continued transferring cryptocurrency into addresses retired following its July 2025 hack. Although CoinDCX had established a system to recover those deposits and move them into secure wallets, the automated service stopped functioning correctly for an undisclosed period.
The resulting accumulation of funds was targeted in unauthorized withdrawals on October 21. CoinDCX said it absorbed the entire 15.99 million USDT loss, maintaining that customer balances, active wallets, trading services and withdrawals remained unaffected.
The confirmation follows several days of questions from blockchain investigators about approximately $16 million in suspicious transactions. While the theft itself was reported on October 21 and 22, the latest development is CoinDCX’s direct acknowledgment of the precise financial loss and its fuller explanation of the operational failure.
CoinDCX explains how deprecated wallets remained operational
In its October 25 incident disclosure, CoinDCX said the affected addresses belonged to older operational infrastructure compromised during its July 19, 2025 security incident.
Following that breach, the exchange deprecated the infrastructure and instructed customers to use updated deposit addresses. However, some users continued sending assets to previously assigned wallets rather than the current addresses displayed in the CoinDCX application.
The company maintained two separate processes to handle these transactions.
First, its accounting system immediately credited incoming deposits to the relevant customer’s portfolio, allowing balances to appear without waiting for the underlying cryptocurrency to move into primary custody.
Second, an automated sweeping service was responsible for transferring those deposits from the deprecated addresses into CoinDCX’s secure operational wallets.
This arrangement was intended to protect customers who mistakenly reused older addresses. However, the sweeping service failed for an unspecified period, allowing deposits to accumulate in infrastructure that the exchange had already identified as vulnerable.
The case highlights an important distinction between a blockchain transfer and the internal systems responsible for deposit processing. As explained in our analysis of sending crypto to an exchange’s old deposit address, a successful on-chain transaction does not necessarily mean that the receiving platform has securely collected the assets.
Blockchain investigators traced $15.99 million across 40 wallets
The latest statement also addresses inconsistencies between CoinDCX’s initial response and blockchain evidence published after the October 21 transfers.
CoinDCX co-founder Sumit Gupta initially disputed reports of a fresh breach, suggesting the suspicious transactions involved addresses compromised in 2025 rather than the exchange’s current infrastructure.
Blockchain investigator ZachXBT subsequently challenged the explanation, pointing to transaction histories indicating that the supposedly retired infrastructure had continued handling deposits after the earlier incident.
Separate research published by blockchain analytics firm Bitquery on October 22 identified approximately 15.99 million USDT transferred from 40 CoinDCX-linked wallets on the TRON network.
Almost the entire amount, approximately 15.82 million USDT, originated from one deposit address beginning TQKJQ. Bitquery identified 88 deposits associated with that address that had accumulated before the unauthorized withdrawals.
The researchers also identified routine deposit-processing activity involving other affected wallets on October 21, demonstrating that the broader infrastructure remained operational despite its deprecated status.
According to Bitquery’s October 22 snapshot, approximately $9.63 million reached deposit addresses associated with OKX, Binance and Gate, while roughly $2.28 million remained in seven wallets associated with the suspected attacker at the time of the investigation.
Those figures describe the funds’ movements at a particular point in time, not their final disposition or confirmed recovery status.
Second security loss follows CoinDCX’s $44 million breach
The latest incident follows a separate security breach in July 2025, when CoinDCX reported approximately $44 million in cryptocurrency exposure involving an internal operational account used for liquidity provisioning.
At the time, the company said the affected account was separated from customer assets and that corporate reserves would cover the financial damage.
The October incident raises additional questions because the affected deposit infrastructure was already known to have been compromised.
CoinDCX said its controls prevented the latest incident from spreading to active wallets and trading systems. It also reported uninterrupted trading, deposits and withdrawals during the preceding 72 hours.
However, the company has not publicly established how the attacker retained or obtained access to the deprecated addresses, precisely when the sweeping service failed, or why the failure was not detected before substantial funds accumulated.
It has pledged stronger monitoring of residual systems and further reminders encouraging customers to update their deposit addresses.
The bigger failure was allowing compromised wallets to hold deposits
The most troubling element is not simply another cryptocurrency theft. It is that an exchange recovering from a major security breach continued accepting the operational risk associated with wallets it had already declared unsafe.
CoinDCX’s reasoning is understandable from a customer-service perspective. People reuse saved deposit addresses, and refusing to help them could leave funds stranded. Automatically crediting their accounts also avoids making customers wait for complicated backend transfers.
But convenience creates a dangerous gap when accounting and custody operate independently.
A customer’s balance can appear correctly in the application even while the corresponding assets remain in a vulnerable wallet. If automated collection fails without effective alerts and escalation procedures, the platform may continue recognizing customer liabilities while the underlying funds accumulate outside secure custody.
The concentration of roughly $15.82 million in a single address makes this particularly significant. It suggests that the financial consequences of a relatively narrow operational failure can become substantial when monitoring does not detect accumulating exposure.
That is why wallet retirement needs to mean more than removing an address from the user interface. Effective retirement also requires controls over historical keys, monitoring of residual balances, exposure limits and clear procedures for deposits arriving after migration.
The distinction matters across the exchange industry. Other platforms, including Bitget, have faced difficult decisions about customer accounts following major security breaches. The circumstances differ, but both cases illustrate how managing operational exposure after an attack can be as important as containing the original incident.
Customer reimbursement protects balances, not company capital
CoinDCX’s decision to absorb the full loss is significant for customers. According to the exchange, deposited assets were credited correctly, meaning affected users did not bear the immediate financial loss.
However, company-funded reimbursement transfers the economic burden to the exchange rather than eliminating it.
The approximately $16 million exposure represents another financial setback following the $44 million incident in 2025. That does not establish that CoinDCX faces insolvency or immediate liquidity problems, but repeated security losses can consume capital that would otherwise support technology investment, expansion or financial reserves.
Customers should also distinguish between an exchange holding sufficient assets and its ability to maintain effective operating controls. As our examination of crypto exchange proof-of-reserves reports explains, reserve transparency alone cannot demonstrate the reliability of every internal system or establish a company’s capacity to absorb unexpected losses.
That makes CoinDCX’s future disclosures important. Investors and counterparties need evidence that the failed process has been corrected and that similar vulnerabilities cannot quietly accumulate substantial balances elsewhere.
What happens next for CoinDCX and the stolen USDT?
The most immediate unanswered question concerns how much of the stolen cryptocurrency can ultimately be recovered.
Transfers into addresses associated with major exchanges may create investigative opportunities, but they do not prove that the assets have been liquidated or that the people controlling the funds have been identified.
Tether’s ability to freeze stolen USDT could also become relevant if investigators identify eligible balances before they move elsewhere. Freezing tokens, however, is different from establishing legal ownership or securing restitution.
CoinDCX’s October 25 statement does not provide a definitive account of recoveries, the attacker’s access method or the duration of the sweeping failure.
The company’s next meaningful step should be a technically detailed explanation of why the compromised wallet infrastructure remained exposed, what monitoring failed and which safeguards have now changed.
The key lesson is straightforward: protecting customer account balances is not the same as securing every asset-processing system behind them. CoinDCX says its users were made whole. Whether the exchange has also fixed the underlying operational weaknesses remains the more important question for its long-term credibility.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574