CoinDCX admitted it lost 15.99 million USDT from deposit wallets it had stopped using after its 2025 hack. The disclosure came days after CEO Sumit Gupta dismissed reports of a breach. The exchange says it absorbed the loss.
Indian crypto exchange CoinDCX admitted it lost 15.99 million USDT, or roughly $16 million, to an attack on deposit wallets it had stopped using after a 2025 hack. The company said it absorbed the loss.
In a blog update, CoinDCX said its automated sweeping service, which moves funds between its wallets, had failed for a particular period. As a result, user deposits built up at an address the exchange no longer used. The exchange also said that all user funds remain safe in cold wallets and that trades, deposits, and withdrawals continued as usual.
Admission follows Wednesday's denials
Darcy, co-founder of asset rescue service provider FlashRescue, first flagged the suspicious outflows on Wednesday. He posted that roughly 15.99 million USDT and 5,783.81 TRX left CoinDCX's hot wallet and several deposit addresses on Tuesday, all bound for one Tron address. From there, the funds were routed to deposit addresses at Binance, OKX and Gate, per Darcy.
Gupta answered that the wallets were not breached. He said the addresses had been compromised in July 2025 and that hackers seemed to be reusing them, so the reports sounded like "a false alarm".
However, onchain analyst ZachXBT pushed back. He wrote that one deposit address was in use by a liquidity provider for 10 months after the July 2025 incident and swept user deposits to CoinDCX's current hot wallet as recently as April and May 2026. He later advised users to withdraw their funds from the exchange.
A second loss after the $44 million hack
CoinDCX then said its sweeping process failed and led to operational losses that the exchange absorbed, though that post gave no figure. The July 2025 hack cost the exchange about $44 million.
Asked about Gupta's earlier statements and ZachXBT's claims, a representative for the exchange's public relations agency referred The Block to the company's blog post and did not address follow-up questions.
Source: The Block
Trading involves risk.
Risk Disclaimer
