CoinDCX confirms $16 million loss from retired wallets days after CEO called breach reports a ‘false alarm’
Indian crypto exchange CoinDCX admitted it lost 15.99 million USDT, or roughly $16 million, to an attack targeting deposit wallets it had stopped using after a 2025 hack. The disclosure comes just days after the exchange's co-founder and CEO, Sumit Gupta, told users on X that reports of a breach sounded like "a false alarm."In an update posted to its blog early Sunday, CoinDCX said it noticed unusual activity on Tuesday that "had impacted our old, deprecated wallet infrastructure which had unknown vulnerabilities." The exchange said its automated sweeping service, which moves funds between the exchange's wallets, "had failed for a particular period," so user deposits had built up at an address the exchange no longer used. "This led to a loss of 15.99 million USDT which was absorbed by the company," CoinDCX said."We want to reiterate that all user funds remain safe in secure, segregated cold wallets, protected by multi-layer custody and offline security controls," CoinDCX wrote, also noting that the exchange's ordinary trades, deposits, and withdrawals continued as usual despite the breach.Admission follows Wednesday's denialsSuspicious outflows from CoinDCX wallets were first flagged at 1:30 a.m. ET on Wednesday by Darcy, the co-founder of asset rescue service provider FlashRescue, who posted that roughly 15.99 million USDT and 5,783.81 TRX left CoinDCX's hot wallet and a handful of deposit addresses at 11:35 a.m. ET on Tuesday. All of the funds went to one Tron address. The biggest single transfer was 15,819,002 USDT, and from there the funds were split up and routed to deposit addresses at Binance, OKX and Gate, per Darcy.Gupta replied to Darcy's post less than three hours later. "Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached," he wrote, adding that the addresses in question had been compromised in July 2025 and that "the hackers seem to be re-using the old wallet addresses and this sounds like a false alarm."CoinDCX's own account followed suit four minutes later, calling the claims "misleading" and saying the addresses "have not been used by CoinDCX since" the July 2025 incident.Onchain analyst ZachXBT soon pushed back on CoinDCX's denials. One deposit address, he wrote, "was in use by a [liquidity provider] for 10 months after your July 2025 incident" and that address swept user deposits to CoinDCX's current hot wallet as recently as April and May 2026. "Meaning $15.8M in user deposits was unaccounted for by your team," he wrote.Gupta answered ZachXBT at 5:59 a.m. ET, saying the team was "investigating it further" and that "no user funds will be at loss." By 7:47 a.m. ET, CoinDCX had posted that its sweeping process failed "for a particular period" and that this "led to some operational losses, which were absorbed by CoinDCX." That post didn't put a number on the losses.ZachXBT then advised users to "withdraw all funds from CoinDCX if you value your assets." He wrote that the exchange's co-founders "publicly and privately denied a theft of its assets occurred meaning they straight up lied or are negligently incompetent," though he said he had still helped freeze stolen crypto worth six figures on behalf of the exchange.$16M loss adds to prior incidentsThe July 2025 hack cost CoinDCX about $44 million, which Gupta blamed at the time on a server breach. Bengaluru police later said hackers posing as recruiters had tricked a CoinDCX software engineer into installing malware on a company laptop that let the hackers access the exchange's internal systems.Onchain drains and phishing attacks aren't the only issues that CoinDCX has faced. Indian police arrested Gupta and co-founder Neeraj Khandelwal in March over a fraud complaint, which CoinDCX said stemmed from scammers impersonating it through a copycat site.Coinbase invested in CoinDCX in October 2025 in a deal Gupta said valued the exchange at $2.45 billion, deepening the U.S.-listed exchange's push into India and the Middle East.Asked about Gupta's earlier statements and ZachXBT's claims, a representative for CoinDCX's public relations agency referred The Block to the company's blog post and did not address specific follow-up questions.