CoinDCX Hit by $16 Million Hack! CEO Calls It a “False Alarm,” Then Admits Losses Three Days Later—Why Was the Hacked Legacy Wallet Still Receiving Funds?

India’s cryptocurrency exchange CoinDCX is embroiled in controversy over its cybersecurity and operational management. After suffering losses of around $44 million in a 2025 hack, the platform officially admitted on October 25 that unauthorized access to its legacy wallet infrastructure, combined with a malfunction in its automated fund-sweeping system, led to the loss of 15.99 million USDT (around $16 million). CEO Sumit Gupta had previously publicly denied a new hacking incident, saying the alerts might be a “false alarm,” before on-chain investigator ZachXBT challenged his claim with transaction records.
On October 22, co-founder and CEO Sumit Gupta denied on-chain alerts reporting the theft of around $16 million, saying the incident might be a “false alarm.” But on the 25th, the exchange officially admitted that its legacy wallet system had indeed been exploited, resulting in losses of around $16 million.
More concerning, these wallets had been decommissioned after the exchange was hacked in 2025. Yet CoinDCX continued processing user funds mistakenly deposited to the old addresses. The failure of its automated sweeping system ultimately left funds stranded at addresses known to be at risk.
Why were $16 million still in old wallets that had long been decommissioned?
According to CoinDCX’s official statement on October 25, the incident can be traced back to October 21. The exchange said the affected addresses belonged to an old wallet system abandoned after a July 2025 hack, but some users continued sending funds to the outdated addresses.
Under normal circumstances, CoinDCX first credits deposits to users’ accounts, then transfers them to secure wallets through an automated fund-sweeping service (Wallet Sweeping). However, this mechanism stopped working properly for a period, causing large amounts of USDT to accumulate at the old addresses, where they were eventually stolen.
CoinDCX said the company would absorb the loss of 15.99 million USDT. Its current trading and wallet systems were unaffected, and deposits, withdrawals, and trading services remained operational.
CEO initially denied a hack; ZachXBT publicly challenged the claim
The incident was first uncovered by on-chain investigator Darcy, who reported an abnormal transfer of approximately 15.99 million USDT from a TRON wallet linked to CoinDCX.
CoinDCX CEO Sumit Gupta later responded that the current wallets had not been compromised. He said the transactions may have involved hackers reusing an old address that had been compromised last year, and described the incident as appearing to be a “false alarm.”
But on-chain investigator ZachXBT soon presented conflicting evidence, noting that one of the addresses involved continued to be used by a liquidity provider after the July 2025 security incident, and that funds were transferred from it to CoinDCX’s current hot wallet in April and May 2026. ZachXBT therefore questioned the platform’s claim that the “old wallets had long been decommissioned,” saying it did not match the actual on-chain transaction records.
CoinDCX eventually acknowledged the loss on October 25, saying that investigating the old infrastructure had taken time. It also admitted that it could have communicated more proactively.
According to Bitquery’s on-chain investigation, the attackers took funds from around 40 TRON addresses linked to CoinDCX. Approximately 15.82 million USDT was lost from a single address alone, accounting for nearly 99% of the total loss.
The investigation found that the attackers split up and transferred the funds. Within about a day of the incident, they sent approximately 9.63 million USDT to deposit addresses at three exchanges: about 5.46 million USDT to OKX, 2.77 million USDT to Binance, and 1.39 million USDT to Gate.
Bitquery’s further tracing found that Tether had frozen nine related addresses on October 22, involving approximately 2.21 million USDT. However, funds flowing into exchanges does not mean they have been successfully cashed out, and the ultimate destination of all the stolen assets has yet to be confirmed.
Hit by security incidents twice, exchange risk controls face renewed scrutiny
CoinDCX suffered a security incident involving approximately $44 million in July 2025. Now, about 15 months later, it has suffered another major loss due to problems with old wallets and its internal fund-handling processes.
The biggest warning from this incident is not just whether private keys or wallets are secure; decommissioning a wallet does not mean all related processes have been shut down. When old addresses continue to receive funds and automated sweeping and risk monitoring fail to operate effectively in tandem, infrastructure considered retired can still become a target for attack.
Although CoinDCX stressed that the company had absorbed the loss and that customer account balances and assets held in segregated cold wallets were unaffected, with trading, deposits, and withdrawals continuing as normal, the attackers’ identities, the specific method of intrusion, and why the company’s internal risk controls failed to prevent funds from accumulating in time all remain under investigation.
“CoinDCX hit by $16 million hack! CEO first calls it a ‘false alarm,’ then admits the loss three days later—why were hacked old wallets still receiving funds?” This article was originally published on (BlockTempo).