CoinDCX management’s denial lasted just one day. After rejecting reports of a nearly $16 million theft, the Indian crypto exchange confirmed the loss of 15.99 million USDT from its legacy wallet infrastructure on October 21, 2026.
This marks the second security incident to hit CoinDCX. In July 2025, the exchange suffered a $44 million breach. Following that initial incident, the legacy operational wallets were retired. However, a failure in the automated deposit-sweeping service caused crypto balances to accumulate at the old addresses, as some users continued sending funds there despite the company’s requests to migrate to new wallets.
On-Chain Data Contradicts Management’s Account
Before the official admission, CoinDCX CEO Sumit Gupta denied reports of a new breach on October 22, 2026. Gupta claimed that the suspected addresses were part of legacy infrastructure that had been compromised since the July 2025 incident. That statement contradicted findings from blockchain investigator Darcy, who identified transfers of roughly 15.99 million USDT and 5,783.81 TRX on the Tron network.
Blockchain researcher ZachXBT also questioned claims that the wallet was no longer in use. ZachXBT pointed to an address tagged TQKJQ that was actually still utilized by liquidity providers for about 10 months after the July 2025 hack, with the latest transactions recorded between April and May 2026. Analysis from intelligence firm Bitquery reinforced the evidence: 88 deposit transactions totaling around 15.82 million USDT accumulated in a single wallet, with 40 addresses identified as affected on the Tron blockchain.
Crucial Questions Still Unanswered to the Public
CoinDCX stated that trading systems and user account balances remain unaffected. All losses are covered directly from the company’s internal reserves. The exchange’s management also acknowledged their delayed communication to the public in a written statement: “We could have been more proactive.”
Nonetheless, CoinDCX has yet to disclose a full technical timeline. The company has not revealed when the automated sweeping service stopped working, how long customer funds were left accumulating at legacy addresses, or how the attacker gained access to the wallet’s private keys.
While the commitment to cover losses from internal reserves protects customer balances for now, the incident serves as a clear warning for crypto asset holders to regularly update their personal transfer lists to prevent deposits from being sent to obsolete wallets whose security has been abandoned by exchanges.
Reported via crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
