CoinDCX admits $16M USDT loss days after CEO dismissed hack alerts

CoinDCX acknowledged on October 25, 2026, that it suffered a loss of 15.99 million USDT originating from decommissioned wallets. Just days prior, on October 22, CEO Sumit Gupta had brushed off breach warnings, labeling them a potential “false alarm.” This reversal raises questions regarding how the exchange monitored those wallets and communicated with its clientele.

A sweeping failure the exchange says it absorbed

CoinDCX explained in a public post that users continued depositing funds into wallets that had been retired following a July 2025 breach. Although an automated sweeping mechanism was designed to route these deposits into active wallets, the platform admitted that the system “had failed for a particular period.”

The company maintained that it covered all affected deposits and absorbed the financial blow, allowing trading and withdrawals to continue uninterrupted. Furthermore, CoinDCX pledged to improve monitoring across its legacy infrastructure.

From ‘false alarm’ to admission

The incident came to light on October 22 when a researcher named Darcy flagged unusual TRON transfers. Gupta suggested at the time that hackers were simply recycling wallets compromised during the 2025 attack, while CoinDCX asserted that certain alerts were misleading.

Cryptopolitan covered the initial denial, which drew skepticism from investigator ZachXBT. He pointed out that these supposedly retired wallets had actually received user deposits as recently as April and May 2026.

What the chain shows versus what CoinDCX says

Data from Bitquery on October 21 revealed that 15.99 million USDT was drained across roughly 40 wallets linked to CoinDCX. A single wallet accounted for $15.82 million of that total across 88 transactions.

On-chain tracking showed the final regular transfer occurring at 12:14 UTC, with the attacker’s initial movement taking place at 12:19 UTC. Bitquery also identified 276 fee top-ups dating back to August alongside sweeping activity that occurred post-theth, directly contradicting claims that the wallets were dormant.

Within an 18-hour window, approximately $9.63 million was funneled through six intermediate wallets to OKX, Binance, and Gate. On October 22, Tether froze $2.21 million spread across nine wallets. A Bitquery snapshot from October 23 indicated that at least $30,000 remained in the attacker’s possession, though blockchain data cannot pinpoint how the unauthorized access was achieved.

A small exchange with a troubled year

DefiLlama figures from October 26 placed CoinDCX’s reserves at $173.3 million alongside a 24-hour spot trading volume of $1.47 million. While reserves represent reported holdings, trading volume measures market activity; neither metric discloses total customer liabilities, leaving it unclear whether user funds are fully backed based on these figures alone.

According to a September report, CoinDCX boasts 23.1 million registered users alongside a ₹57.07 crore Crypto Investor Protection Fund. While this fund offers an extra layer of defense, it does not guarantee reimbursement for every type of loss. This distinction is particularly critical given that CoinDCX previously suffered a roughly $44 million loss during a July 2025 security breach prior to this $16 million event.

Why the governance questions travel

The situation at CoinDCX highlights broader vulnerabilities in cryptocurrency security. TRM Labs reported that during the first half of 2026, infrastructure and operational breaches accounted for about 76% of all crypto hacking losses despite making up only 15% of total incidents—demonstrating that while such failures may be less frequent, their financial impact is often devastating.

The scrutiny surrounding CoinDCX’s handling of the crisis extends beyond its user base. Coinbase took a stake in the exchange in October 2025 to support its push into India and the Middle East, a region where Chainalysis ranks India sixth globally for grassroots crypto adoption. Given this market interest, how CoinDCX manages the fallout is vital. While covering the financial deficit was necessary, rebuilding credibility demands more transparency regarding why an active wallet drain was initially dismissed as a “false alarm.”

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It’s free.