TLDR
- CoinDCX, India’s largest crypto exchange by trading volume, says it lost 15.99 million USDT and will absorb the loss.
- The loss came from a retired wallet that a failed sweeping service left holding customer deposits.
- CEO Sumit Gupta first called the reports a false alarm on X.
- Bitquery traced about $9.63 million to OKX, Binance and Gate, and Tether froze about $2.21 million.
- CoinDCX says customer funds, trading, deposits and withdrawals were not affected.
CoinDCX, India’s largest crypto exchange by trading volume, says it lost 15.99 million USDT. The company said it will absorb the full amount. It shared the news in an October 25 statement.
Update on the on-chain Wallet Activity – 21st October 2026
Our full update on the recent on-chain activity, what happened, and what it means for you.
User funds remain safe, and trading and withdrawals continue as usual.
Read the full update: https://t.co/fSr10QlkJh— CoinDCX (@CoinDCX) October 25, 2026
The story began last week, when blockchain investigators flagged about $16 million in suspicious outflows. The wallets were linked to the Mumbai-based exchange. CEO Sumit Gupta quickly called the reports a false alarm on X.
A spokesperson told CoinDesk that the addresses were old ones. They were created in January 2025 and were compromised in a July 2025 hack. That attack cost the exchange about $44 million.
On-chain investigator ZachXBT questioned that explanation. He said one address, labeled TQKJQ, was used by a liquidity provider. He said it swept user deposits to CoinDCX’s current hot wallet as recently as April and May 2026.
What CoinDCX Says Went Wrong
CoinDCX said the wallet belonged to its old operational infrastructure. The company retired that setup after the July 2025 breach. Some users kept sending deposits to the old addresses anyway.
The exchange credited those users the moment funds arrived. A separate service, called sweeping, was meant to move the money into the main CoinDCX wallet. That service failed for a period, and deposits piled up in the retired address.
CoinDCX said it noticed unusual activity on October 21. It found irregular fund movements the next day through blockchain records and community reports. The company has not said when the service stopped working. It also has not said how outside parties gained control of the money.
The blog post does not call the event a hack. It does not name who was behind the transfers.
Where the Funds Went
Bitquery, a blockchain analytics firm, reviewed Tron network records. It found 88 deposits totaling about 15.82 million USDT had gathered in one wallet. It also identified 40 affected addresses.
About $9.63 million moved through middle wallets to deposit addresses tied to OKX, Binance and Gate. That happened within 18 hours of the main transfer. Tether froze about $2.21 million across nine wallets on October 22.
CoinDCX’s statement did not mention any recovery of assets. It also did not name who received the missing funds.
Earlier, investigator Darcy had flagged transfers of about 15.99 million USDT and 5,783.81 TRX. Gupta had suggested the earlier attackers might be reusing the compromised addresses.
Customer Impact and Regulators
CoinDCX said all user funds remain safe in segregated cold wallets. It said trading, deposits and withdrawals continued without limits. The exchange admitted it could have been more proactive in its communication.
CoinDCX is registered with India’s Financial Intelligence Unit as a reporting entity. Its October 25 disclosure did not say whether it told FIU-India, CERT-In or another authority. No regulatory investigation had been confirmed in the reviewed records.
The company plans to strengthen monitoring of older wallet systems. It also reminded customers that support for retired deposit addresses is temporary. It urged users to check their current deposit address before sending crypto.
