Indian cryptocurrency exchange CoinDCX has confirmed a loss of approximately $16 million, specifically 15.99 million USDT, following an incident on its wallet infrastructure. The disclosure reverses earlier statements by CEO Sumit Gupta, who had characterized reports of the breach as a "false alarm." According to the company's blog post, the funds were drained from wallets that had been retired after a separate hack in July 2025. An internal process designed to sweep customer deposits out of these legacy addresses failed, leaving the residual funds exposed on the Tron network. The transfer occurred on October 21.
The admission follows public disputes with blockchain investigators, including ZachXBT, who challenged Gupta’s initial denial. ZachXBT noted that the compromised wallets were still actively sweeping user deposits into CoinDCX’s current hot wallet as recently as April and May, urging customers to withdraw their assets due to negligence or misrepresentation. CoinDCX stated it absorbed the loss itself and assured users that their balances remain unaffected. This event compounds previous security issues for the Mumbai-based exchange, which suffered a roughly $44 million hack in July 2025 attributed to a server breach. That earlier incident led to bounty hunts and the arrest of an employee. Together, the two incidents bring CoinDCX’s total losses to nearly $60 million. The exchange indicated it would share further details as its investigation continues.
CoinDCX’s confirmation of the $16 million loss highlights significant operational risks associated with managing legacy infrastructure following security breaches. The failure of automated processes to clear retired wallets demonstrates how incomplete remediation can create new vectors for theft, even when primary systems are secured. The reversal of the CEO’s initial "false alarm" statement raises serious questions about internal communication protocols and crisis management transparency. Publicly denying a breach before fully understanding the scope of infrastructure vulnerabilities can erode trust more severely than the financial loss itself, particularly when independent investigators provide contradictory on-chain evidence.
From a regulatory and credibility standpoint, this incident underscores the challenges facing Indian crypto exchanges in maintaining robust compliance and security standards. The accumulation of nearly $60 million in losses across two major incidents within a year may attract heightened scrutiny from regulators and institutional partners. While the company asserts customer funds are safe, the pattern of security failures suggests systemic weaknesses in asset custody procedures. Stakeholders should monitor whether CoinDCX implements verifiable improvements to its wallet management systems and how it addresses the reputational damage caused by the discrepancy between executive statements and technical realities.
