CoinDCX has confirmed an internal loss of about $16 million from retired deposit wallets while stating that customer balances were not affected. The Indian exchange said 15.99 million USDT was drained from deprecated Tron wallets after sweeping failures and legacy vulnerabilities, and it added that the company would absorb the loss rather than pass it to users.
The problem centered on an automated service that was supposed to sweep deposits from old deposit addresses into current secure wallets. According to CoinDCX, that service quietly failed, so user deposits accumulated in the old infrastructure instead of being moved into the main treasury. Investigators traced roughly 15.99 million USDT and about 5,783 TRX from CoinDCX-related wallets into a single Tron address and then on to venues including Binance, OKX and Gate. CoinDCX described the event as an operational wallet loss rather than a breach of a live trading wallet, and independent reporting matched that basic account. Tether reportedly froze around $2.2 million of the stolen USDT across several addresses, but there was no sign yet that most of the funds had been recovered.
CoinDCX insists that customer funds remain safe in segregated cold wallets and that trading, deposits and withdrawals continued. The exchange also said users who accidentally sent funds to old addresses were credited immediately. Even so, the episode raised questions about communication and operational discipline. CEO Sumit Gupta initially called breach reports a false alarm and suggested attackers were only reusing addresses from a prior 2025 incident before the company later confirmed the new loss. Onchain analysts such as ZachXBT publicly disputed that narrative, citing continued use of one of the addresses by a liquidity provider months after the earlier hack. The new loss also follows a roughly $44 million hack in 2025 tied to a compromised internal account, which had already raised concerns about internal controls and employee-targeted attacks.
The incident highlights several risk themes for CoinDCX users and for centralized exchange users more broadly. Operational risk is the first theme because failures in automated sweeping and monitoring of old deposit addresses show that infrastructure debt can be as dangerous as hot wallet exposure. Communication risk is the second theme because the gap between initial denials and later admissions shows why users and regulators scrutinize exchange statements after suspicious onchain movements. Regulatory and market risk is the third theme because Indian regulators may investigate, and counterparties and users could reassess exposure or demand clearer proof of reserves and stronger wallet lifecycle management. For users, the practical lessons are to stick to current deposit addresses obtained directly from the app or website, minimize idle balances on any centralized exchange, and monitor how venues handle prior incidents, including whether they disclose timeline, cause and remediation clearly.
CoinDCX’s $16 million retired wallet loss looks like a mix of legacy infrastructure risk and monitoring failure rather than a direct hit on current customer wallets. It nevertheless reinforces concerns about the exchange’s security culture and transparency. The broader takeaway for crypto users is that centralized exchange risk often hides in unglamorous plumbing such as old deposit addresses and sweepers, so venue choice and custody habits remain as important as token selection.
