CoinDCX confirms $16 million loss from retired wallets compromised in its 2025 hack

Indian crypto exchange CoinDCX confirmed in a blog post early on Sunday, October 25, 2026 that it lost 15.99 million USDT, about $16 million, after user deposits built up at old, deprecated deposit wallets that had been compromised in its July 2025 hack. The exchange said its automated sweeping service, which moves funds out of those addresses, "had failed for a particular period," so deposits accumulated at an address it no longer used. The outflow on October 21 moved 15.99 million USDT and about 5,784 TRX to one Tron address. CoinDCX said it absorbed the loss, credited affected deposits, and that active wallets and user funds in segregated cold wallets are unaffected, with trading, deposits and withdrawals continuing as usual. Tether froze about $2.21 million USDT on October 22.

The confirmation reverses the exchange's first response. Co-founder and chief executive Sumit Gupta initially called reports of a breach a false alarm, and the company called the claims misleading, before saying it was investigating further and that no user funds would be at loss. On-chain analyst ZachXBT had pushed back, saying at least one deposit address remained in use by a liquidity provider for months after the July 2025 incident and swept user deposits as recently as April and May 2026. The July 2025 hack cost CoinDCX about $44 million. Prepared as a Cybersecurity item, not a Breaches add: no personal record count is stated.

Sources: The Block; CryptoBriefing