On October 25, 2026, CoinDCX confirmed that it lost 15.99 million USDT from retired wallets. Before that, on October 22, CEO Sumit Gupta had dismissed the breach warnings as just a possible “false alarm.” The turnaround brings into doubt how the exchange kept track of those wallets and conveyed information to its customers.
A sweeping failure the exchange says it absorbed
In a post, CoinDCX said that customers were still sending deposits to wallets that were retired due to the hack in July 2025. The platform’s automated sweeping service was supposed to transfer those deposits into active wallets. However, according to the exchange, it “had failed for a particular period.”
The exchange claimed to have compensated all deposits and taken the hit. Trading and withdrawals proceeded as normal. CoinDCX has committed to keeping a better eye on its old systems.
From ‘false alarm’ to admission
The controversy began on October 22, when researcher Darcy flagged suspicious TRON transfers. Gupta thinks that hackers have been reusing wallets that were compromised in 2025. CoinDCX claimed that certain reports were found to be misleading.
The explanation was questioned by investigator ZachXBT, who pointed out that the allegedly retired wallets were used to transfer deposits recently in April and May 2026. Cryptopolitan reported on the denial.
What the chain shows versus what CoinDCX says
On October 21, Bitquery found out that 15.99 million USDT was transferred from a number of 40 wallets associated with CoinDCX. One of those wallets controlled $15.82 million, which came from 88 transactions.
The last regular transfer was made at 12:14 UTC, while the first move of the thief happened at 12:19 UTC. Bitquery also discovered 276 fee top-ups since August and sweeping activity after the theft. The information contradicts the statement that the wallets were inactive.
Approximately $9.63 million has been transferred using six intermediate wallets to OKX, Binance and Gate within a time frame of 18 hours. Tether has frozen $2.21 million in nine wallets on October 22. At least $30,000 still exists in the thief’s wallets, according to Bitquery’s snapshot taken on October 23. The blockchain is unable to provide information about how the perpetrator accessed the wallets.
A small exchange with a troubled year
On October 26, DefiLlama listed CoinDCX’s reserves at $173.3 million and its 24-hour spot trading volume at $1.47 million. The numbers stand for different things: reserves indicate reported assets, while trading volume reflects market activity. Neither reveals how much CoinDCX owes customers, making it impossible to know from these numbers alone whether customer deposits are fully backed.
CoinDCX’s September report recorded 23.1 million registered users and a ₹57.07 crore Crypto Investor Protection Fund. The fund provides an additional safeguard, but it does not guarantee coverage for every loss. That distinction matters because CoinDCX had already lost roughly $44 million in a July 2025 hack, before the latest $16 million incident.
Why the governance questions travel
CoinDCX’s case reflects a wider weakness in crypto security. TRM Labs found that infrastructure and operational compromises caused roughly 76% of crypto hack losses in the first half of 2026, despite accounting for just 15% of incidents. Such failures may be relatively uncommon, but their financial consequences can be severe.
The questions surrounding CoinDCX’s response also extend beyond its customers. Coinbase invested in the exchange in October 2025 as part of its expansion into India and the Middle East. Chainalysis ranks India sixth globally for grassroots crypto adoption. With growing interest in the region, CoinDCX’s handling of the incident matters. Covering the loss was necessary, but restoring trust requires something more: explaining why it initially dismissed an active wallet drain as a “false alarm.”
The smartest crypto minds already read our newsletter. Want in? Join them.