✓ Verified by 3+ outlets USDT
CoinDCX admits $16 million USDT loss from retired wallets after CEO first called it a 'false alarm'
Summary
Indian crypto exchange CoinDCX said in a blog update early Sunday, Oct. 25, that it lost 15.99 million USDT, roughly $16 million, from old deposit wallets it stopped using after its July 2025 hack, and that the company absorbed the loss, The Block reported.
The outflows were first flagged on X on Wednesday, Oct. 21, by Darcy, co-founder of FlashRescue, and CoinDesk reported on Oct. 23 that the exchange initially denied its active wallets were compromised, with CEO Sumit Gupta calling the reports a false alarm.
Onchain investigator ZachXBT disputed that account, saying one of the addresses was still used by a liquidity provider and swept user deposits into CoinDCX's current hot wallet as recently as April and May 2026, according to both outlets.
CoinDCX blamed a temporary failure of its automated sweeping service, which let user deposits pile up at a retired address, and said user funds remain in segregated cold wallets with trading, deposits and withdrawals continuing as usual.
The two outlets describe the exchange's stance at different stages: CoinDesk's Oct. 23 report carried the denial plus an admission of unquantified operational losses, while The Block's Oct. 25 report covers the confirmed 15.99 million USDT figure.
Updates
- Update, : Update: CoinDesk reported on Oct. 26 that the Mumbai-based exchange, which first dismissed the outflow reports as a false alarm, now says it lost $16 million and will absorb the loss, tying it to an internal process failure at a retired wallet.
- Update, : Update: Decrypt reported that 15.99 million USDT was drained from wallets CoinDCX retired after last year's $44 million hack, bringing its combined losses to nearly $60 million, which the exchange says it is absorbing.
Key facts
- CoinDCX said the attack cost 15.99 million USDT, 'which was absorbed by the company.'
- Darcy said about 15.99 million USDT and 5,783.81 TRX left CoinDCX's hot wallet and several deposit addresses, all sent to one Tron address, with the largest transfer at 15,819,002 USDT.
- Per Darcy, the funds were then split and routed to deposit addresses at Binance, OKX and Gate.
- A CoinDCX spokesperson told CoinDesk the addresses were created in January 2025, compromised in July 2025, and that some users kept depositing to them despite past notifications.
- CoinDCX said it credited every affected user and that its current addresses were not hit.
- ZachXBT advised users to withdraw their funds from CoinDCX, though he said he helped freeze six figures of stolen crypto on the exchange's behalf.
- CoinDCX's July 2025 hack cost about $44 million; Coinbase invested in the exchange in October 2025 at a valuation Gupta put at $2.45 billion.
Related stories
- Binance sets aside $6.34 billion to cover record hack as TRM and Chainalysis tie it to North Korea's TraderTraitor
- Tron and Tether bring in Chainalysis for a new crime task force after their T3 unit with TRM Labs folded
- KPMG gives Tether Gold a clean audit, counting every bar behind $2.2 billion of XAUT