CoinDCX has disclosed a $15.99 million loss stemming from a breakdown in its internal wallet transfer system, reversing its earlier dismissal of reports about suspicious transactions. India’s largest cryptocurrency exchange by trading volume said it would cover the loss using company funds.
The controversy began last week when blockchain analysts identified roughly $16 million in unusual outflows from addresses linked to the Mumbai-based exchange. CoinDCX initially denied that the activity indicated a problem, with CEO Sumit Gupta calling the reports a false alarm on X.
The exchange later told CoinDesk that the addresses had been created in January 2025 and were compromised in a July 2025 security breach that reportedly cost the company around $44 million. CoinDCX said the wallets had since been retired and were no longer part of its operations.
However, on-chain investigator ZachXBT questioned that explanation, reporting that at least one address, TQKJQ, was still being used by a liquidity provider. According to the investigator, funds from that address were transferred to CoinDCX’s current public hot wallet as recently as April and May 2026.
In a blog post released Sunday, CoinDCX confirmed that TQKJQ was associated with its legacy wallet infrastructure and acknowledged that the issue had resulted in a financial loss. The company reiterated that the wallet had been compromised during the incident disclosed on July 19, 2025, after which it was taken out of service.
CoinDCX said some customers continued sending deposits to these discontinued addresses despite the decommissioning. The exchange credited the funds to the customers’ accounts upon receipt, while a separate automated process was expected to move the assets into its primary wallet.
That transfer mechanism, known internally as “sweeping,” failed during a specific period. Consequently, deposits accumulated in the retired wallet instead of reaching the main wallet as intended.
The company confirmed that the failure resulted in a loss of 15.99 million USDT, which it has agreed to absorb.
CoinDCX did not describe the latest event as another hacking incident or explain the precise circumstances behind the irregular fund movements. It also did not identify anyone responsible. CoinDesk contacted the exchange to ask whether the old wallet addresses had been breached again.
Reassuring users, CoinDCX said customer assets remain secure in segregated cold wallets protected by layered custody arrangements and offline safeguards. These wallets are kept disconnected from the internet to reduce exposure to online threats.
The exchange added that it needed additional time to examine its retired wallet infrastructure and verify the sequence of events. It acknowledged that a faster response would have been preferable but said it published its explanation once the investigation had established a clearer picture of the incident.
