CoinDCX just admitted something it denied days earlier — and honestly, the denial bothers me more than the hack itself.
India's exchange confirmed about $16 million was stolen — 15.99 million $USDT — from wallet infrastructure it had supposedly retired after a hack in July last year. The story, reported by The Block, is that an automated system meant to sweep deposits out of that old wallet stopped working, so customer deposits kept piling up in it, and attackers walked in through the leftover vulnerability. CoinDCX says it covered the loss itself and that customer funds in segregated cold wallets are safe, with trading continuing normally.
Here's my take: this is the part of exchange risk nobody prices in. It's not some exotic zero-day — it's housekeeping. An old wallet that should have been dead, a sweep job that quietly failed, and a team that first called the on-chain evidence misleading before admitting the loss. On-chain analyst ZachXBT had already flagged that the wallet kept processing deposits after last year's hack. The blockchain doesn't forget, and denial just burns the trust you need when you eventually come clean.
For anyone keeping size on an exchange, this is your reminder to check how much you're actually trusting a platform's internal plumbing. I keep trading balances small and sweep the rest to self-custody, precisely because 'customer funds are safe' is a sentence you only hear after something already went wrong.
Do you still trust exchanges to self-report incidents honestly, or should on-chain sleuths be the ones we actually listen to?
India's exchange confirmed about $16 million was stolen — 15.99 million $USDT — from wallet infrastructure it had supposedly retired after a hack in July last year. The story, reported by The Block, is that an automated system meant to sweep deposits out of that old wallet stopped working, so customer deposits kept piling up in it, and attackers walked in through the leftover vulnerability. CoinDCX says it covered the loss itself and that customer funds in segregated cold wallets are safe, with trading continuing normally.
Here's my take: this is the part of exchange risk nobody prices in. It's not some exotic zero-day — it's housekeeping. An old wallet that should have been dead, a sweep job that quietly failed, and a team that first called the on-chain evidence misleading before admitting the loss. On-chain analyst ZachXBT had already flagged that the wallet kept processing deposits after last year's hack. The blockchain doesn't forget, and denial just burns the trust you need when you eventually come clean.
For anyone keeping size on an exchange, this is your reminder to check how much you're actually trusting a platform's internal plumbing. I keep trading balances small and sweep the rest to self-custody, precisely because 'customer funds are safe' is a sentence you only hear after something already went wrong.
Do you still trust exchanges to self-report incidents honestly, or should on-chain sleuths be the ones we actually listen to?
