CoinDCX, a major Indian cryptocurrency exchange, has revealed a $16 million loss following a security incident involving an old, deprecated wallet. The company confirmed that suspicious activity detected on October 21 led to a loss of 15.99 million USDT, which was absorbed by the company itself. Customer funds remained unaffected, and the exchange assured users that its active wallets and trading systems continued to operate normally.
The admission comes just days after CEO Sumit Gupta publicly denied any breach, suggesting that the activity might be linked to attackers reusing old addresses from a previous hack in July 2025. Gupta had stated that CoinDCX wallets were not breached and warned against spreading false rumors. However, further investigation revealed that an automated sweeping service had failed, allowing deposits to accumulate in the deprecated wallet instead of being transferred to secure infrastructure.
CoinDCX emphasized that user balances were fully accounted for and that those who mistakenly deposited funds to the old addresses were credited immediately. The exchange is now working to address the vulnerabilities in its deprecated wallet infrastructure to prevent similar incidents in the future.