Key Takeaways:
- CoinDCX announced a $15.99M USDT loss from the old wallet infrastructure in the last contaminated security event impacting the platform in 2025.
- The exchange said that an automated sweeping program malfunctioned, and that deposits were made at an old address and then lost.
- Customer balances, withdrawals and active trading systems did not get affected, said CoinDCX of the loss suffered by it.
Indian crypto exchange CoinDCX has confirmed losing nearly $16 million in USDT after funds accumulated in wallet infrastructure the company had already retired following an earlier security breach.
This revelation immediately follows on-chain research of suspicious transfers from addresses associated with CoinDCX, which questioned the logic of receiving deposits while wallets allegedly deemed “deprecated”.
CoinDCX Says Failed Wallet Sweep Caused $15.99M Loss
According to CoinDCX, they noticed unusual transactions on October 21 and also spied on unusual fund transfers through blockchain information and community reports.
During the investigation, it was revealed that the activity had an impact on old operating wallet infrastructure that had been affected in the July 2025 incident. A backend service which used to sweep incoming deposits on those addresses into secure CoinDCX wallets went offline for a period, causing coins to pool there.
The loss of USDT was CoinDCX’s loss of 15.99 million USDT, which the exchange reported that it covered. The exchange has stated that their existing wallets and trading systems are not impacted. The company reported trading and deposits and withdrawals were seamless, and assets held by users were still demand-deposited in segregated cold-wallet custody.
Read More: Initia Halts L1 and Rollups After $2.7M Exploit Tied to Unauthorized Token Minting
Old Deposit Addresses Were Still Receiving Crypto
Despite providing notice to update the deposit address, some users are continuing to send coins to older deposit addresses, CoinDCX said.
Its recovery system was divided into two parts: when the funds were sent to an old wallet, users were credited, and a subsequent automated service transferred them to the main secure wallets of CoinDCX.
The expensive incident highlighted the problems with retaining access to previous compromised wallet infrastructure. If the sweeping process fails, deposits may stay in addresses whose security exposure is known.
On-Chain Data Challenged the ‘Deprecated Wallet’ Label
Blockchain researchers have raised questions about the workings of the less active wallets. According to Bitquery, one address held approximately $15.82 million of USDT and the company tracked 15.99 million USDT in 40 CoinDCX-related Tron wallets. It was a routine deposit-related operation through its investigation up to the day of the incident.
Additionally, approximately $9.63 million was traced to addresses that were linked to Binance, OKX and Gate across a period of about 18 hours. CoinDCX has not responded in public about the source of the unauthorized party unlocking these funds.
The authentication was made just days after CoinDCX CEO Sumit Gupta challenged the initial breach reports.
The flagged addresses were from infrastructure breached in 2025 and Gupta had said that the new ones were a “false alarm” in terms of concerns. Later, CoinDCX has publicly admitted that it has been still interacting with those addresses, which were handling its own deposits.
Read More: ZachXBT Says Chinese Crime Ring Laundered $1B+ for Lazarus After $1.5B Bybit Hack
