After denying a breach on October 22, CoinDCX, an India-based cryptocurrency exchange, confirmed three days later that it had lost 15.99 million USDT from a deprecated wallet linked to a previous cyberattack.
The Mumbai-based crypto exchange later admitted that its automated sweeping service had failed for a “particular period” due to “unknown vulnerabilities” in its “old, deprecated wallet infrastructure.” Automated sweeping is a process through which the company transfers funds from a deprecated address to its primary, secure wallet.
The current loss is approximately 2.4 times the previous breach: At the time of writing, one USDT was valued at Rs. 95.07, according to Binance’s figures. This would amount to Rs 152.02 crore. This is not the first time the crypto exchange has lost money in a cyberattack. In July 2025, CoinDCX suffered a $44.2 million breach that, as MediaNama reported, cost the company about Rs 368 crore. The latest loss is approximately 2.42 times smaller than the loss in the 2025 breach.
The initial denial of the attack: Before CoinDCX publicly acknowledged the breach, Darcy Niu disclosed it. Niu is the vice president of global law enforcement cooperation at Salus, a cybersecurity research team focused on Web3, and the co-founder of FlashRescue, a digital-asset investigations company that investigates crypto fraud and wallet theft.
In response, CoinDCX’s CEO called the claims a “false alarm” and asked people not to spread rumours. As MediaNama reported in its October roundup of Indian data breaches, organisations have repeatedly denied or downplayed breaches or narrowed their reported scope in their initial responses.
CoinDCX’s co-founder and chief executive, Sumit Gupta, replied that “CoinDCX wallets are not breached” and asked people not to spread rumours. He argued that the addresses had been compromised in 2025 and that attackers were reusing them. The exchange’s X account said the flagged addresses “have not been used by CoinDCX since” and described the breach claims as misleading.
— Sumit Gupta (@smtgpt) October 22, 2026Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don't spread rumours.
The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the… https://t.co/6hKfTtffHK
The company said it had noticed unusual activity in its systems and launched a deeper investigation following reports from the community.
“However, the next day we noticed irregular fund movement via the blockchain data and through reports from our user community. A deeper investigation revealed that the unusual activity had impacted our old, deprecated wallet infrastructure which had unknown vulnerabilities. The investigation also revealed that our automated sweeping service had failed for a particular period, causing deposits to accumulate in the deprecated address. This led to a loss of 15.99 million USDT which was absorbed by the company.” – CoinDCX.
How crypto exchanges have addressed transparency following cyberattacks:
- CoinSwitch: In March 2026, CoinSwitch published its proof-of-reserves report. Read the full report here.
- WazirX: In 2023, WazirX published an independent report on its proof of reserves. Read MediaNama’s coverage here.
- CoinDCX: In 2022, CoinDCX published its proof of reserves. Read MediaNama’s coverage here.
Also read
- How India’s First Crypto Unicorn CoinDCX Lost Rs 368 Crore
- India Mandates Cybersecurity Audits for Crypto Exchanges
- WazirX Attacked By North Korean Hackers, USD 230 Million Stolen
For You
- Read Reasoned by Nikhil Pahwa: How AI is changing our world
- Sign up for MediaNama's Daily Newsletter to receive regular updates
- Sponsor a MediaNama Event
Post navigation
Saying that the 0.4% MDR on UPI will “uplift its payments processing margin” by 2.5 basis points, Paytm added that its business model doesn’t “depend on UPI MDR for growth”, it’s “an upside, not its foundation”.