Quick answer: Yes. On Oct. 25, 2026, CoinDCX confirmed a loss of 15.99 million USDT from retired wallets compromised in its July 2025 hack, after a deposit-sweeping service failed. The exchange says it absorbed the loss and that user balances are safe, three days after its CEO called the theft claims a possible false alarm.
The CoinDCX loss is now official. India’s largest crypto exchange confirmed on Oct. 25, 2026, that 15.99 million USDT was taken from its old wallet system on Oct. 21. Only three days earlier, its CEO called the theft reports a possible false alarm.
The reversal matters for every exchange user, not only CoinDCX customers. The money sat in addresses the exchange had retired after a hack more than a year ago, yet users kept sending deposits there.
We covered the first round of this story when CoinDCX denied a new hack and ZachXBT flagged $15.8M in unaccounted deposits. Here is what changed.
What did CoinDCX confirm on Oct. 25?
In a blog post titled “Update on the on-chain Wallet Activity”, CoinDCX said it noticed unusual activity on Oct. 21. The next day, blockchain data and user reports showed irregular fund movements.
According to the exchange, the activity hit its “old, deprecated wallet infrastructure which had unknown vulnerabilities.” It also said its “automated sweeping service had failed for a particular period,” so deposits built up in a single retired address, known as TQKJQ. The result was a loss of 15.99 million USDT, which “was absorbed by the company.”
CoinDCX added that its active trading and wallet systems ran without pause. It said user funds remain in segregated cold wallets. It also admitted: “We could have been more proactive.”
Why were retired CoinDCX wallets still taking deposits?
The old wallets were exposed in the July 19, 2025 security incident, when CoinDCX lost about $44 million from an internal account. The exchange says it deprecated the whole system that year.
However, some users kept depositing to the old addresses. Rather than leave those users stuck, CoinDCX ran two separate processes:
- Instant credit: users got their balance as soon as funds reached the old address.
- Sweeping: a background job then moved the coins into the main, secure wallet.
When the sweeping job stopped, coins stayed in an address the July 2025 attackers could still reach. On-chain analysts at Bitquery counted 88 deposits worth about 15.82 million USDT in one wallet, crypto.news reported.
How did CoinDCX’s story change?
The timeline shows a clear shift:
- Oct. 21, 15:35 UTC: researcher Darcy flags about 15.99 million USDT and 5,783.81 TRX leaving CoinDCX-linked addresses on Tron.
- Oct. 22: CEO Sumit Gupta says “CoinDCX wallets are not breached” and points to attackers reusing old addresses. ZachXBT replies that address TQKJQ was still used by a liquidity provider into April and May 2026.
- Oct. 23: CoinDesk reports that CoinDCX still denies a hack but admits a temporary failure in its sweeping process caused operational losses.
- Oct. 25: CoinDCX publishes the full account and puts the loss at 15.99 million USDT.
ZachXBT was blunt. “Withdraw all funds from CoinDCX if you value your assets,” he wrote on X on Oct. 22, accusing the founders of denying the theft.
Where did the USDT from the CoinDCX loss go?
Bitquery’s Tron analysis found 40 affected addresses. About $9.63 million moved through middle wallets to deposit addresses linked to OKX, Binance and Gate within 18 hours, crypto.news said. Tether then froze about $2.21 million across nine wallets on Oct. 22.
CoinDCX’s statement did not mention any recovery. It also did not say whether it informed India’s Financial Intelligence Unit (FIU-India) or CERT-In. Key gaps remain: when the sweep failed, how long funds piled up, and how the attacker got the keys.
What does the CoinDCX loss mean for crypto users?
For CoinDCX customers, the company says balances are fully accounted for and withdrawals are normal. Still, the episode raises fair questions about trust and disclosure, a theme we also saw in the Keystone wallet data breach.
For everyone else, the lesson is simple:
- Copy a fresh deposit address every time. Old addresses can be retired or, worse, compromised.
- Don’t reuse saved addresses in your wallet’s address book without checking the exchange app first.
- Watch how a platform talks during an incident. Fast, specific updates are a better sign than flat denials.
Exchange incidents can also shake prices across the market; follow the live Bitcoin price for the bigger picture.
Not financial advice. Do your own research (DYOR) before using any exchange or moving funds.
CoinDCX Loss FAQ
How much did CoinDCX lose in October 2026?
CoinDCX confirmed a loss of 15.99 million USDT on Oct. 25, 2026. The funds left old wallets on Oct. 21, and the company says it absorbed the full amount.
Are user funds on CoinDCX safe?
CoinDCX says yes. Its Oct. 25 statement says customer balances are unaffected, user funds sit in segregated cold wallets, and trading, deposits and withdrawals ran without pause.
Was this a new CoinDCX hack?
CoinDCX says the losses came from wallet infrastructure first compromised in its July 2025 incident. A failed sweeping service let deposits pile up there, so the money was exposed through an old weakness, not its current wallets.
Did Tether freeze any of the stolen USDT?
Yes. Bitquery’s analysis, cited by crypto.news, says Tether froze about $2.21 million across nine wallets on Oct. 22, 2026. CoinDCX has not announced any recovery.
How can I avoid sending crypto to an old exchange address?
Always copy the current deposit address from the exchange app or website right before each transfer. Don’t reuse addresses saved in your wallet, since exchanges can retire them.
Sources
- CoinDCX: Update on the on-chain Wallet Activity (Oct. 25, 2026)
- crypto.news: CoinDCX admits $15.99M loss days after denying hack claims (Oct. 25, 2026)
- CoinDesk: CoinDCX denies hack, blames broken clean up job (Oct. 23, 2026)
- TokenPost: CoinDCX says company will cover $15.99M legacy wallet loss (Oct. 25, 2026)
- PANews: CoinDCX loss to be borne by the company (Oct. 25, 2026)
