Key Highlights
- CoinDCX confirmed a loss of 15.99 million USDT linked to old, deprecated operational wallet infrastructure with previously undetected vulnerabilities.
- An automated sweeping mechanism failed to move incoming user funds into current secure storage, allowing user deposits to gather in the obsolete wallet.
- CoinDCX absorbed the entire loss, affirming that customer accounts, live trading systems, and standard deposits and withdrawals remain unaffected.
Investigation Details Breach of Legacy Wallet Infrastructure
Indian cryptocurrency exchange CoinDCX revealed that it identified abnormal on-chain transactions, prompting a comprehensive technical investigation. The inquiry revealed that the anomalous activity targeted an old, deprecated operational wallet framework that harbored previously unidentified security weaknesses.
During the review, CoinDCX established that an automated sweeping routine had ceased functioning properly over an extended interval. Consequently, cryptocurrency deposits transferred by users into one of the deprecated addresses built up over time rather than routing through normal channels into the exchange’s current, secured storage environment.
According to an official disclosure, This led to a loss of 15.99 million $USDT, which was absorbed by the company,
adds the statement. CoinDCX emphasized that its primary trading systems, active wallet networks, deposits, and withdrawal pathways maintained seamless operations throughout the event. Customers who inadvertently transferred assets to the outdated addresses received immediate credit on the platform, while an internal secondary system was designated to route the underlying funds elsewhere.
Executive Clarification Follows Initial Denial
The formal confirmation followed an earlier statement from CoinDCX executive Sumit Gupta, who initially dismissed reports of a platform compromise. After on-chain researchers and intelligence firm Arkham identified approximately $16 million in irregular movements, Gupta insisted that CoinDCX wallets are not breached
and cautioned the public against amplifying unverified claims.
In his initial reaction three days prior, Gupta argued that the flagged addresses dated back to a compromise in July 2025 and did not reflect current vulnerabilities. Gupta wrote on social media:
Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don’t spread rumours.
The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the previous hack in July 2025. The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm. We have checked all the present CoinDCX central and user addresses. None of them have sent money to these old addresses.
All the CoinDCX addresses are public and can be seen on our POR link. None of these have sent funds to the above addresses in question and none of the CoinDCX funds got compromised.
Will keep you posted if any new info comes to us as the team is investigating it further. More details to follow from the official CoinDCX handles soon.
Subsequent forensic work by the exchange confirmed that the deprecated infrastructure was indeed involved in the exploit, resulting in the multi-million dollar asset drain.
Why This Matters
The incident at CoinDCX underscores the enduring risks associated with managing legacy crypto infrastructure, technical debt, and dormant smart-contract or wallet endpoints. In centralized exchange operations, automated background services such as sweeping routines are vital for transferring customer deposits into cold storage. When those secondary tasks fail silently, deprecated addresses can quietly accumulate high-value balances, creating prime targets for malicious actors. By fully covering the 15.99 million USDT deficit, CoinDCX prevented user financial disruption, but the breach highlights the necessity for continuous surveillance of both active and decommissioned blockchain systems.
Frequently Asked Questions
Did CoinDCX users lose any funds during this incident?
No. CoinDCX confirmed that all customer balances were credited without interruption. The platform fully absorbed the 15.99 million USDT loss using corporate resources.
How did the attackers access the funds?
The exploit targeted a legacy, deprecated operational wallet structure that contained unknown vulnerabilities. An automated sweeping service had malfunctioned, causing user deposits to accumulate at the old address rather than sweeping into the exchange’s secure, modern infrastructure.
Are normal exchange operations impacted?
No. CoinDCX stated that its active wallet systems, order books, spot trading, deposit services, and withdrawals continue to run normally.
