Indian cryptocurrency exchange CoinDCX has confirmed a $16 million loss following an attack on its wallet infrastructure, contradicting its CEO’s earlier dismissal of the incident as a “false alarm.” The company revealed in a blog post that 15.99 million USDT was drained, though it assured customers that their funds remain secure. The breach occurred on October 21, 2026, when the money was transferred on the Tron network. CoinDCX traced the issue to a failure in an internal process designed to move customer deposits from retired wallets after a much larger hack last year.
The exchange’s admission came days after CEO Sumit Gupta disputed reports of a breach on X, claiming the flagged addresses had been compromised in July 2025. On-chain investigator ZachXBT challenged this explanation, noting that the wallet in question had still been processing deposits as recently as April and May. He urged customers to withdraw their assets as a precaution.
The latest incident adds to CoinDCX’s recent troubles. In July 2025, the exchange suffered a $44 million hack attributed to a server breach, leading to a bounty hunt for the stolen funds and the arrest of an employee. The retired wallets involved in the new loss were a remnant of that earlier breach, as they continued to receive residual deposits despite being decommissioned. The automated transfer system meant to clear these funds failed, leaving them vulnerable.
CoinDCX has faced other challenges this year, including fraud and impersonation-scam allegations that prompted a police investigation. The exchange’s founder also denied reports of acquisition talks with Coinbase following the 2025 hack. Coinbase has been expanding its presence in South Asia and the Middle East. CoinDCX stated it would provide further details as its investigation continues and reiterated that user balances are unaffected.