On October 25, 2026, CoinDCX, an Indian cryptocurrency exchange, disclosed that it had lost approximately $15.99 million in USDT due to a breach of its earlier wallet infrastructure, following initial denials of such claims. This announcement emerged after a series of suspicious wallet transfers were identified, prompting scrutiny from blockchain researchers.
CoinDCX’s statement revealed that the incident involved an older operational wallet that had been retired after a significant security breach in July 2025, which resulted in a loss of $44 million. The exchange reported that a malfunction in its automated deposit cleaning service led to cryptocurrencies accumulating in this compromised wallet.
Details of the Incident
The exchange recognized that the unusual wallet activity had gone unnoticed until it observed irregular fund movements on October 22, a day after the suspicious transfers were reported. CoinDCX’s leadership initially refuted the claims of another security breach, asserting that no funds had been transferred from its currently operational wallet.
CEO Sumit Gupta addressed the situation on October 22, stating that the flagged addresses were linked to the earlier compromised infrastructure. He suggested the detected activity could be a false alarm, as some customers may have mistakenly continued to use old deposit addresses despite guidelines instructing them otherwise.
Compromised Wallet Processing Transactions
The admission of losses sparked concerns about why the compromised wallet was still operational. CoinDCX explained that due to its commitment to customer service, the exchange allowed deposits to be credited immediately, even if they were sent to obsolete addresses. This automated process was meant to facilitate quick transfers to secure wallets.
However, the company did not clarify when the automated cleaning service ceased functioning or how long the unauthorized funds were accumulating in the wallet after it was deemed obsolete. Blockchain analyst ZachXBT noted that certain addresses linked to the compromised wallet remained active for months after the breach.
Tracing the Breached Funds
Subsequent investigations by blockchain experts traced the November 21 transaction across multiple wallets. They identified around $9.63 million linked to intermediaries that quickly maneuvered the funds to addresses associated with major exchanges such as OKX, Binance, and Gate within a short timeframe. Tether also reportedly froze $2.21 million across nine wallets shortly thereafter.
This incident marks a continued pattern of security challenges for CoinDCX, which previously acknowledged a significant security breach in July 2025. The exchange claims to have restored normal operations and emphasized that user funds remained secure during the latest incident.
Regulatory Implications
Given that CoinDCX is registered with India’s Financial Intelligence Bureau as a reporting entity, questions arise regarding whether the exchange reported the latest incident to relevant authorities, such as the Financial Intelligence Unit of India (FIU) or the Indian Computer Emergency Response Team (CERT-In). As of now, there appear to be no confirmed regulatory inquiries related to the recent events.
Throughout the incident, CoinDCX maintained that transactions, deposits, and withdrawals continued without disruption. The exchange also pledged to enhance the monitoring of older wallet systems and advises users to verify their current deposit addresses before making transactions, emphasizing the risks associated with transferring funds to outdated wallets.
This incident sheds light on the ongoing challenges within the cryptocurrency space, particularly concerning security protocols and the importance of customer communication during crises.
