From CryptoPotato · By Jordan Lyanchev
One of India’s leading crypto trading platforms, CoinDCX, confirmed that suspicious activity detected earlier this week ultimately led to a 15.99 million USDT loss tied to wallet infrastructure compromised during a previous security incident.
The admission comes only days after CEO Sumit Gupta publicly said the exchange’s wallets had not been breached and suggested the alarm could be linked to attackers reusing old addresses.
The company’s official October 25 update says the team noticed unusual activity on October 21 and initially prevented any impact to its active wallet and trading infrastructure.
However, they detected irregular blockchain movements shortly after and launched a deeper investigation, which determined that the activity had affected an old, deprecated operational wallet infrastructure containing previously unknown vulnerabilities.
CoinDCX also discovered that an automated sweeping service had failed for some time, and deposits sent by users to one of the deprecated addresses accumulated there instead of being transferred into the exchange’s current secure wallet infrastructure.
“This led to a loss of 15.99 million USDT, which was absorbed by the company,” adds the statement.
The exchange stressed that its active wallets, trading systems, deposits, and withdrawals continued operating normally and that customer balances were fully accounted for. Users who mistakenly deposited to deprecated addresses were still immediately credited, while a separate process was supposed to sweep those funds elsewhere.
Interestingly, this acknowledgment is particularly noteworthy given Gupta’s initial response just three days earlier. After blockchain researchers flagged roughly $16 million in suspicious transfers, the exec stated that “CoinDCX wallets are not breached” and warned against spreading false rumors.
He said at the time that the addresses involved had belonged to the exchange before its July 2025 hack and had been compromised during the incident.
Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don’t spread rumours.
The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the previous hack in July 2025. The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm. We have checked all the present CoinDCX central and user addresses. None of them have sent money to these old addresses.
All the CoinDCX addresses are public and can be seen on our POR link. None of these have sent funds to the above addresses in question and none of the CoinDCX funds got compromised.
Will keep you posted if any new info comes to us as the team is investigating it further. More details to follow from the official CoinDCX handles soon.