Indian cryptocurrency exchange CoinDCX has acknowledged operational losses caused by a failed deposit-sweeping process after blockchain investigators traced approximately $15.99 million in USDT leaving 40 wallets associated with the platform, contradicting its initial explanation that the affected addresses were no longer in use.
The unauthorized transfers occurred on October 21, but the central developments emerged on October 22, when an investigation by blockchain analytics firm Bitquery revealed that CoinDCX’s deposit infrastructure had continued processing transactions through wallets the exchange described as abandoned following a July 2025 security breach.
CoinDCX subsequently admitted that its process for collecting deposits from previously compromised addresses had failed for an unspecified period. The company said affected customers had received the appropriate account credits and that it had absorbed the resulting operational losses.
However, CoinDCX did not disclose its exact financial loss, the number of customers involved or how the suspected attacker obtained access to the wallets.
How Did $15.99 Million Leave CoinDCX Wallets Still Processing Deposits?
Bitquery’s October 22 investigation identified approximately 15.99 million USDT transferred from 40 CoinDCX-linked wallets on the TRON blockchain into a newly created address.
Almost the entire amount, approximately $15.82 million, originated from a single deposit address beginning TQKJQ. The address had accumulated 88 deposits between late January and March 2026, which remained untouched until the October 21 drain.
Investigators found that the exchange’s automated deposit infrastructure was still operating through other affected addresses on the day of the theft.
According to Bitquery, a CoinDCX-linked hot wallet funded a deposit address with TRX to cover transaction fees at approximately 12:14 UTC on October 21. Five minutes later, the first suspicious transfer was initiated.
The investigation also identified 276 transaction-fee top-ups from the affected hot wallet since August, each followed by movements consistent with automated deposit collection.
All 35 smaller deposit addresses involved in the drain had processed outgoing deposits after September 1, while 22 had done so during the week preceding the incident.
These findings directly challenged CoinDCX’s initial assertion that the affected wallets had not been used since the previous security breach.
CoinDCX Revises Explanation and Confirms Operational Losses
CoinDCX initially rejected suggestions of a fresh compromise, stating that the relevant addresses had been affected by its July 2025 hack and subsequently retired.
Co-founder Sumit Gupta similarly maintained that the exchange’s current operational wallets had not been breached.
Blockchain investigator ZachXBT challenged that explanation, highlighting transaction activity indicating that the TQKJQ deposit address had continued receiving funds and transferring deposits into CoinDCX’s existing infrastructure months after the previous incident.
In a subsequent official clarification published October 22, CoinDCX acknowledged that customers continued sending cryptocurrency to deprecated addresses despite earlier warnings.
The company explained that it maintained a process for transferring those deposits into secure storage, but the process failed for a period before the problem was identified on October 22.
CoinDCX said the resulting operational losses were borne by the company and that affected user accounts had already been credited for their deposits.
It maintained that customer assets remained in segregated cold wallets, currently active addresses were unaffected and trading operations continued normally.
The revised statement establishes that the exchange was still handling deposits sent to the supposedly retired addresses. However, it does not establish the complete method of compromise or confirm that the entire $15.99 million represented a final, unrecoverable corporate loss.
Where Did the Stolen USDT Go After the October 21 Transfers?
Bitquery traced approximately $9.63 million in USDT to deposit addresses associated with OKX, Binance and Gate within roughly 18 hours of the initial transfers.
Of that amount, approximately $5.46 million reached OKX-associated addresses, $2.77 million reached Binance-associated addresses and $1.39 million reached Gate.
Another $4.1 million moved into heavily used wallets whose operators could not be reliably identified. A smaller amount, exceeding $100,000, moved through blockchain bridges.
At Bitquery’s October 22 snapshot, taken at 12:15 UTC, approximately $2.28 million remained across seven wallets associated with the suspected attacker. The research indicated that none of those balances had been frozen by Tether at that point.
Importantly, deposits into centralized exchanges do not demonstrate that the cryptocurrency was sold, withdrawn into fiat currencies or permanently lost beyond recovery.
These transactions may instead provide investigators with opportunities to identify account holders and potentially coordinate restrictions on remaining balances.
The situation highlights the importance of stablecoin freezing mechanisms, particularly Tether’s ability to restrict transfers from identified USDT addresses.
Why Does the July 2025 Breach Make This Incident More Serious?
CoinDCX previously suffered a security incident on July 19, 2025, involving approximately $44 million in cryptocurrency held in an internal operational account used for liquidity provisioning.
The company said at the time that customer assets were unaffected and that it would absorb the financial exposure through corporate reserves.
The latest episode raises a different question: whether the exchange sufficiently isolated and retired vulnerable infrastructure after discovering the earlier breach.
Bitquery’s analysis found that some affected addresses had been active years before 2025 and that transactions continued through the wallets long after CoinDCX said they had been retired.
Although CoinDCX attributes the latest losses to a failed deposit-sweeping process, the precise relationship between the two security incidents remains unresolved.
Other cryptocurrency exchanges have faced similar challenges in protecting operational infrastructure. Dave Finances previously examined Bitget’s response following a $387.5 million security breach, illustrating the financial and customer-confidence consequences that can follow major compromises.
The Bigger Problem Is What Happened After CoinDCX Knew the Wallets Were Compromised
The most concerning aspect of this case is not simply that nearly $16 million moved out of exchange-linked wallets. Cryptocurrency platforms have suffered major thefts before, and even sophisticated security systems cannot eliminate every threat.
What makes this incident different is the apparent failure to fully separate compromised infrastructure from continuing deposit operations.
Once an exchange determines that a wallet’s private keys may be exposed, that wallet should no longer be treated as a secure destination for customer funds. Simply removing the address from the deposit interface does not prevent customers, payment partners or automated systems from sending money to it.
CoinDCX says it warned users against depositing into deprecated addresses. But the company also continued operating a process intended to recover those deposits, creating an arrangement in which funds could still accumulate inside vulnerable infrastructure.
The $15.82 million concentration in one address makes the control failure particularly consequential. According to Bitquery, those deposits remained there for months while other addresses continued being swept.
That raises an uncomfortable question: why did a system designed to protect deposits leave such a substantial balance exposed for so long?
Customer Reimbursement Does Not Eliminate the Financial Risk
CoinDCX’s assurance that customers received their account credits is important. If accurate and fully backed, it means the company, rather than affected customers, absorbed the immediate financial consequences.
But absorbing a loss does not make it disappear. It transfers the economic burden to the exchange’s shareholders and corporate resources.
CoinDCX already committed reserves to cover the approximately $44 million July 2025 incident. Another material operational loss could increase pressure on profitability, liquidity management and future investment in security infrastructure.
There is also a distinction between having assets in cold storage and operating an effective customer-accounting system.
As explored in Dave Finances’ analysis of crypto exchange proof-of-reserves reports, on-chain asset verification does not independently establish whether customer liabilities are accurately recorded, operational processes are reliable or an exchange can withstand unexpected losses.
Those questions become especially important when the disputed balances originated in customer deposit addresses rather than an isolated corporate trading account.
What CoinDCX Must Explain to Restore Confidence
CoinDCX now faces several questions that its October 22 clarification did not fully resolve.
When did its deposit-sweeping process stop functioning correctly? Why were compromised addresses still receiving operational support? How much of the $15.99 million came from previously credited customer balances? And what controls prevented, or failed to prevent, the same problem from recurring after July 2025?
The answers matter more than the exchange’s insistence that its currently active wallets remain secure.
Customers need confidence that the balances displayed in their accounts correspond to assets the exchange can actually safeguard and deliver. Investors and counterparties need to understand whether repeated losses represent isolated security failures or weaknesses in operational governance.
CoinDCX’s decision to absorb customer-related losses may prevent immediate financial harm to affected users. But the credibility of that assurance ultimately depends on transparent reconciliation, demonstrated custody controls and a convincing explanation of how previously compromised infrastructure remained involved in deposit processing.
The October 22 disclosures therefore leave CoinDCX facing a problem larger than the reported $15.99 million drain: proving that the security failures revealed by the incident have been identified and corrected, rather than simply absorbed as another cost of doing business.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574