CoinDesk
CoinDCX absorbed a $15.99 million loss after an internal sweeping service failed to transfer customer deposits from a compromised wallet that the exchange had retired after its July 2025 security breach. The Mumbai-based exchange initially dismissed roughly $16 million in suspicious outflows as a false alarm, then acknowledged that users continued sending funds to deprecated addresses. Customer balances, active wallets and trading systems were unaffected, and CoinDCX said it would cover the loss itself.
Why it matters
The addresses were created in January 2025 and compromised in the July 2025 breach, which cost CoinDCX about $44 million. After the incident, the exchange continued crediting users whose deposits reached the deprecated wallet, while a separate sweeping service was supposed to move those funds into its primary wallet. That process failed for a period, allowing deposits to accumulate in an address that the exchange said it had stopped using.
The episode is an operational-control failure layered on top of an earlier security breach. CoinDCX said customer deposits were fully accounted for, and that user funds remained in segregated cold wallets protected by multi-layer custody and offline controls. It also acknowledged that its initial response and delayed disclosure could have been faster.
The exchange has not identified who moved the funds or said that the retired addresses were hacked again. That distinction matters because the reported loss arose from a failed transfer process, while the precise cause of the irregular movement remains unresolved.
Market impact
For CoinDCX, absorbing $15.99 million converts a treasury issue into a direct test of customer trust. The exchange's initial dismissal of on-chain warnings also created a dispute with blockchain sleuths, including ZachXBT, who said one address labeled TQKJQ had been used by a liquidity provider to sweep user deposits into CoinDCX's current public hot wallet as recently as April and May 2026.
The broader lesson is that removing an address from active infrastructure does not remove it from user behavior or the public ledger.
Frequently asked questions
-
What caused CoinDCX to lose $15.99 million?
A secondary sweeping service failed to move customer deposits from a deprecated wallet into CoinDCX's primary wallet. The exchange absorbed the resulting $15.99 million loss.
-
Were customer funds lost in the CoinDCX incident?
CoinDCX said customer deposit balances were fully accounted for and that its active wallets and trading systems were unaffected. The company said the loss was absorbed by the exchange.
-
How is the latest loss connected to CoinDCX's July 2025 breach?
The deprecated address was compromised during the July 2025 breach, which cost CoinDCX about $44 million. Users continued depositing to that address, and the later sweeping failure left the funds exposed.
-
Did CoinDCX initially acknowledge the suspicious outflows?
No. CEO Sumit Gupta initially called the reports a false alarm. CoinDCX later acknowledged the $15.99 million loss and said it should have disclosed the incident sooner.
-
Was the CoinDCX loss caused by another hack?
CoinDCX did not call the event a hack and has not said the retired address was compromised again. It attributed the loss to a failed sweeping process and said the party behind the irregular fund movement was unknown.
TheBlock
WuBlockchain
WatcherGuru
Lookonchain