CoinDCX Confirms a $15.99M Loss It Denied Three Days Earlier

CoinDCX has confirmed losing 15.99 million USDT from wallet infrastructure it stopped using more than a year ago. The Indian exchange published the statement on Sunday, three days after its chief executive rejected reports of a fresh breach. The company said it will cover the loss itself and that customer balances were never touched. No recipient has been identified and no recovery has been announced.

Three days between the two accounts

The transfers went out on 21 October. About 15.99 million USDT and 5,783.81 TRX left addresses identified as CoinDCX wallets on Tron. The movement was public the next day. Sumit Gupta, the exchange's chief executive, rejected the second-hack reading on 22 October. His position was that the addresses belonged to infrastructure compromised in July 2025 and that nothing had moved from current operational wallets. He suggested the old attackers were reusing addresses they already held, calling it a possible false alarm. None of the accounts read here carries a verbatim quote from him. By Sunday the company's statement put the loss at 15.99 million USDT and said it could have been more proactive.

A sweep that stopped running

The explanation in Sunday's statement is mundane. An automated service that swept funds out of the retired addresses stopped working, and deposits customers were still sending there piled up. The wallet was generated in January 2025 and abandoned after the July 2025 incident. TokenPost dates it to 19 July 2025 and says an unknown vulnerability survived the retirement. It is alone on both points. Affected users have had their deposits credited, and customer assets sit in segregated cold wallets.

"User funds remain safe, and trading and withdrawals continue as usual," the statement said.

That line is itself unstable. PANews, summarizing the same post on X, renders it as "User funds are entirely safe, and trading and withdrawal services are operating as usual." One statement, two English versions, and this desk did not open the original.

Two names for the first alert

Who spotted the outflow depends on the outlet. crypto.news and FinanceFeeds credit a blockchain investigator called Darcy. Crypto Briefing says Arkham Intelligence was first, tying the movements to addresses labeled as CoinDCX wallets on Tron. Nothing read here settles the order. The analytics firm Bitquery is read two ways too. crypto.news has it finding 88 deposits totaling about 15.82 million USDT in a single wallet, with about $9.63 million reaching deposit addresses at OKX, Binance and Gate within 18 hours. FinanceFeeds has the same firm examining 40 Tron wallets and describing about 15.82 million USDT as one transaction out of one address. Eighty-eight deposits and a single transfer are not the same finding.

Tether froze about 2.21 million USDT across nine addresses on 22 October. FinanceFeeds puts $2.28 million left in seven addresses that day, which is not the same claim. ZachXBT, who paid $349,700 to sit inside a laundering ring, disputed the denial on the day it was made. He pointed to an address beginning TQKJQ that a liquidity provider kept using for about ten months after the July 2025 breach, into May 2026. crypto.news alone gives the address. If the claim holds, customer deposits were landing at an address the exchange treated as compromised. FinanceFeeds cautions that transaction records alone cannot establish that every transfer was unauthorized.

What the statement does not say

CoinDCX has not said when the sweeping service failed or how the attackers obtained the keys. Nothing in the statement mentions notifying FIU-India or CERT-In, and crypto.news identified no confirmed regulatory investigation. India's financial intelligence unit sought takedowns of 15 offshore platforms in September. Whether it takes an interest in a domestic exchange absorbing its own loss is not on the record.

The earlier breach is the other loose end. crypto.news and Crypto Briefing put it at about $44 million, taken from an internal liquidity account. FinanceFeeds gives $44.2 million. The two figures do not reconcile. Added together, the two incidents come to roughly $60 million absorbed in fifteen months. That is this desk's arithmetic, not the company's, and CoinDCX has published no cause for the second one.