CoinDCX Confirms $15.99 Million Loss From Retired Wallet Sweep Failure

CoinDCX, the Mumbai-based crypto exchange, confirmed on October 25, 2026, that it absorbed a $15.99 million loss in USDT plus 5,784 TRX from roughly 40 retired TRON-network deposit and hot wallet addresses. The incident involved addresses generated in January 2025 that had been flagged after a prior security event.

Timeline and Technical Details of the Outflows

On-chain analysts first reported suspicious transfers on October 21, 2026. The largest single transaction moved approximately 15.82 million USDT from address TQKJQ. Subsequent movements split the funds, with roughly 9.63 million USDT reaching deposit addresses at Binance, OKX, and Gate.io. Tether froze 2.21 million USDT in connected wallets on October 22.

CoinDCX stated that the addresses had been deprecated after a July 19, 2025 incident that resulted in a separate 44 million dollar loss. An automated sweeping mechanism intended to move incoming deposits to primary wallets stopped functioning for an unspecified period, allowing accumulated balances to remain exposed. Investigators noted that some addresses continued limited sweeping activity into April and May 2026.

The exchange described the latest event as an operational failure rather than a new breach of active systems. Current hot wallets, cold storage, and trading functions remained unaffected, according to the company.

Company Response and User Protections

CoinDCX said it credited all affected user deposits from its treasury. The firm reiterated that trading, deposits, and withdrawals on active addresses continue without interruption. Users were directed to verify current deposit addresses through the official app or website before making transfers.

CEO Sumit Gupta initially labeled early reports of a breach a false alarm on social media. The exchange later issued updates acknowledging the sweep failure and outlining plans to improve monitoring of legacy wallet systems. No recovery timeline for the transferred funds was provided.

Most of the moved USDT remains unrecovered. The exchange has committed to additional internal controls but has not disclosed further loss figures or identified a specific perpetrator.

Context From Prior Incidents and Industry Scrutiny

The October 2026 loss follows the July 2025 security incident, which CoinDCX attributed to a server leak and social engineering. Some on-chain researchers disputed whether all compromised addresses had been fully retired after that event. The latest episode has renewed attention on wallet hygiene practices at exchanges that maintain large numbers of legacy addresses.

Regulators and market participants are expected to examine CoinDCX post-incident controls. The company has not announced changes to its insurance coverage or reserve policies in connection with the loss.