Key Highlights
- Indian crypto exchange CoinDCX absorbed a $15.99 million USDT loss linked to an outdated, deprecated operational wallet infrastructure.
- The issue arose after users continued sending deposits to legacy addresses retired following a security incident reported on July 19, 2025, triggering an automated sweeping failure.
- CoinDCX confirmed that all customer crypto balances remain fully accounted for, with core trading operations and active wallet infrastructure unaffected.
CoinDCX Discloses $15.99M Loss Tied to Legacy Operational Wallets
Major cryptocurrency exchange CoinDCX has experienced an unauthorized drain of roughly $15.99 million in Tether (USDT) originating from a retired wallet address. The platform stated that the incident stems from outdated systems that were supposed to be decommissioned following a previous cyberattack.
Detailing the breach, the company clarified the background of the affected address: “This wallet belongs to our old operational wallet infrastructure, which was compromised during the security incident we reported on July 19, 2025, and was deprecated as a result,” CoinDCX said.
Mechanism Behind the Deprecated Address Failure
According to an explanation shared by CoinDCX, several customers inadvertently routed new token transfers into obsolete deposit addresses, despite the exchange having officially deprecated them after the July 2025 compromise. Under normal exchange procedures, CoinDCX immediately credited the portfolios of those users upon receiving the funds in the decommissioned system.
To safely secure these incoming balances, CoinDCX utilized an automated background mechanism termed “sweeping,” designed to retrieve assets from the deprecated addresses and transfer them into the platform’s primary, secure reserve wallets. However, that automated sweeping pipeline malfunctioned during a specific window, allowing incoming user deposits to stack up in the compromised, deprecated wallet rather than being safely shifted to the main vaults.
Unauthorized Transfers and Corporate Absorption
This technical breakdown created a vulnerable accumulation point that was subsequently drained without authorization. CoinDCX confirmed that “This led to a loss of 15.99 million USDT which was absorbed by the company,” it said.
The company’s announcement avoided labeling the incident an explicit hack and refrained from detailing who orchestrated the transactions or precisely how the exploit was executed. CoinDesk has reached out to CoinDCX to clarify whether the breach signifies that the decommissioned addresses experienced a secondary cyber intrusion.
Timeline of Detection and Customer Asset Safety
CoinDCX noted that its internal surveillance first flagged abnormal telemetry inside its infrastructure on Oct. 21. Management affirmed that security guardrails and immediate emergency response protocols successfully insulated all active wallets and primary trading environments from external tampering.
The following day, on Oct. 22, the platform detected irregular fund movement through on-chain blockchain monitoring tools alongside alerts submitted by members of its user community. Despite the multimillion-dollar impact, CoinDCX reiterated that end-user assets are secure, maintaining that customers’ crypto deposit balances are unaffected and fully accounted for.
Why This Matters
The incident emphasizes the ongoing operational vulnerabilities cryptocurrency exchanges face when managing legacy infrastructure and migration workflows. Decommissioned addresses frequently present attack vectors if deposit routing relies on background sweeps rather than fully blacklisting or disabling deprecated wallets on-chain. By covering the $15.99 million deficit from its corporate treasury, CoinDCX aims to preserve client trust and maintain liquidity stability, though the exploit highlights structural hazards associated with managing retired crypto infrastructure.
Frequently Asked Questions
Did CoinDCX users lose their cryptocurrency balances?
No. CoinDCX confirmed that user portfolios were properly credited and that all customer deposit balances are fully accounted for, with the company absorbing the entire $15.99 million USDT shortfall itself.
What caused the funds to build up in the vulnerable wallet?
Users mistakenly sent new deposits to deprecated wallet addresses retired after a July 19, 2025 security event. An automated secondary “sweeping” system that was intended to move these assets to secure master wallets failed over a specific period, allowing the funds to accumulate in the insecure address.
Are CoinDCX trading services or active wallets compromised?
No. CoinDCX reported that security protocols deployed during the Oct. 21 anomaly detection prevented any breach of its active wallet systems, order books, or ongoing customer trading services.
