The Indian crypto exchange CoinDCX has admitted to the loss of 15.99 million USDT as a result of wallet infrastructure being hacked, after it had denied that close to $16 million (roughly Rs. 152.2 crore) had been stolen from its platform. According to CoinDCX’s October 25 statement, the October 21 attack compromised the legacy wallets operated by the company, which were phased out after a July 2025 cyberattack worth $44 million (roughly Rs. 418.7 crore). It was reported that because of a failure in their automated deposit-sweeping tool, crypto deposits were made to addresses that customers were supposed to stop using.
CoinDCX Blames Inactive Deposit-Sweeping System for October Wallet Breach
CoinDCX bore the loss, and it confirmed there were no consequences for the exchange’s account balance or operations. This admission came after a few days of dispute between CoinDCX management and blockchain forensics experts over suspicious transactions using wallets tied to the exchange. Sumit Gupta, the CEO of CoinDCX, ruled out any new security breach on October 22, saying the flagged addresses belonged to infrastructure compromised in July 2025.
The recent information sheds light on why old wallets that were affected over a year ago still processed client transactions. As per the reports from CoinDCX, the customers were sending cryptocurrencies to the old deposit addresses despite the fact that the company had already updated its affected infrastructure.
In contrast to leaving behind the deposits, it retained an automated system that credited customers’ balances instantly upon receipt of funds. A distinct process took care of depositing the coins received at the old addresses into secure operational wallets. The company mentioned that this approach ensured that users could use their credited balances while waiting for the completion of wallet transfers.
Nevertheless, it has remained unclear as to when the sweeping services became inactive, the period during which the funds kept piling up, and the exact way through which the money got into the wrong hands. A blockchain researcher by the name of ZachXBT had raised doubts about the fact that the wallets were now inactive, citing an address that started with TQKJQ.
CoinDCX has been registered with the Financial Intelligence Unit (FIU) India as a reporting entity under anti-money laundering and counter-terrorist financing obligations. But the disclosure made by CoinDCX on October 25 did not make any mention of whether it has informed FIU-India, CERT-In, or any other government agency in India regarding the recent issue. Any kind of investigation or enforcement action against the transactions that took place on October 21 could not be found in the available records.
