“CoinDCX got hacked again” was circulating in chats. The figure alone comes to about 15.99 million USDT, or roughly $16 million. However, this concerns CoinDCX, the Indian exchange, and its old (decommissioned) wallets and failed automatic sweeps. It was not a Binance hack, nor is it a price signal. I’ll stick to what’s in public reports and the company’s own announcement.
❓ 【Where had the funds accumulated before they were drained?】
According to CoinDCX’s official blog (On-Chain Activity Update, 2026-10-21), suspicious activity was detected in old operational wallet infrastructure that had been decommissioned after the July 2025 security incident. Automatic sweeps—the process of moving funds deposited to old addresses into the main wallet—had been paused for a while, so deposits accumulated at the old addresses, resulting in a loss of 15.99 million USDT. The company said it covered the loss itself.
The Block (2026-10-25) also relayed the same figures, summarizing that old or decommissioned deposit addresses were targeted. Our company said current trading and deposits/withdrawals are operating normally, and repeated that user assets are kept separately in cold wallets and the like.
❓ 【What was the CEO talking about when he called it a "false alarm"】
After unusual outflows were first spotted on-chain, the CEO posted on X saying it seemed like a "false alarm." A few days later, the blog disclosed a failed sweep and the amount of losses in detail. That is why people are pointing out that "what was said at first differs from what was said later." But what we should do is not bet on whether someone else's exchange was hacked; we should check our own deposit address and phishing emails again.
❓ 【Where should I click right now】
Use only the **latest deposit address** shown in the exchange app. Old addresses copied earlier, links sent in chat saying "move funds from the old address," and emails saying "we're the security team and will help with the sweep" should all be refused for now. Even one different character in an address means a different wallet.
Just because it is another exchange incident, don't read it as "ours is definitely compromised too." On the other hand, there is also no basis to assume "we are safe." All you need to keep as a habit is to compare the address inside the app before depositing, and check withdrawal/security alert messages.
❓ 【Short Q&A】
Q. Was Binance hacked?
A. No. This figure refers to about 15.99 million USDT that CoinDCX disclosed as involving an old wallet and a failed sweep. Another exchange's incident ≠ a Binance hack.
Q. What about DMs saying they can "find the balance in an old wallet"?
A. Treat it as phishing if they ask for an address, seed phrase, or code through chat, email, or remote support rather than the official UI. Use only the deposit address inside the app.
Risk: leftover balances in old or unused addresses and phishing "sweep on your behalf" offers can lead directly to losses. Based on public reports and the company's announcement; not investment advice.
Do you still use a deposit address you copied long ago? Yes / No / Not sure — leave a comment.