CoinDCX confirms $16M loss tied to old wallet infrastructure
Security & Exploits ·
The Indian exchange reversed course days after its chief executive dismissed reports of a new breach, now attributing a 15.99 million USDT shortfall to compromised legacy wallets.
CoinDCX disclosed that unusual activity flagged on October 21 eventually traced back to deprecated operational wallet infrastructure left over from an earlier security incident, resulting in a loss of 15.99 million USDT, according to an October 25 statement reported by CryptoPotato. The company said it absorbed the loss itself rather than passing it on to customers.
The root cause, per the exchange, was a failure in an automated process meant to sweep incoming deposits out of old addresses and into current, secure wallet infrastructure. Because that sweep stopped functioning, funds sent by users to one retired deposit address piled up there instead of moving to safer storage, exposing them to the previously undetected vulnerabilities in that legacy system. CoinDCX said users who deposited into the deprecated address were nonetheless credited in full, and that live trading, deposit, and withdrawal systems were unaffected throughout.
The admission stands in contrast to statements made just three days earlier by chief executive Sumit Gupta, who had told users that CoinDCX wallets were not breached after researchers flagged roughly $16 million in suspicious transfers. At the time, Gupta attributed the flagged addresses to a prior hack from July 2025, argued that attackers were simply reusing old wallet addresses, and said none of the exchange's current central or user addresses had sent funds to them, calling the alarm a false one pending further investigation.
The episode is also being tracked by The Block, which likewise notes the gap between the CEO's initial dismissal and the exchange's later confirmation of the loss from retired wallets. Coverage of the incident spans at least three distinct sources, underscoring the scrutiny the reversal has drawn.
What remains unclear is how long the sweeping failure persisted before detection, how the previously unknown vulnerabilities in the deprecated infrastructure were introduced, and whether any additional legacy wallets carry similar exposure. CoinDCX has not detailed further remediation steps beyond absorbing the loss and affirming that active systems were not compromised.