CoinDCX, a major crypto exchange, has confirmed operational losses after a failure in its process to secure deposits sent to old, compromised wallet addresses. The issue arose despite the company's warnings to users to switch to updated addresses following a security incident in July 2025. The exchange acknowledged that some users continued depositing crypto into the discontinued addresses, and a sweep process intended to move these funds for security failed, leading to losses absorbed by CoinDCX.
The company did not disclose the exact amount lost but assured users that all affected deposits had been credited to their accounts. CoinDCX emphasized that customer funds in active wallets remained secure, stored in segregated cold wallets, and that trading operations continued without disruption. The exchange had previously denied claims of a fresh breach, stating that hackers appeared to be reusing compromised addresses from the 2025 incident.
Blockchain investigator Darcy had flagged transfers of around $16 million worth of cryptocurrency from wallets linked to CoinDCX, which were subsequently split across multiple addresses and routed to exchanges like Binance, OKX, and Gate. CoinDCX has not confirmed whether these amounts correspond to the operational losses it disclosed. The exchange's cofounder and CEO, Sumit Gupta, denied any fresh wallet breach and stated that the team was investigating further.
The latest development highlights the challenges crypto exchanges face in managing legacy addresses post-security incidents. CoinDCX had previously lost around $44 million in a cyberattack in July 2025, which it absorbed as operational losses. The exchange had also launched a recovery bounty program to trace and recover the stolen assets.