Indian crypto exchange CoinDCX confirmed that it lost 15.99 million USDT from wallets it had discontinued, days after its CEO called reports of a breach a false alarm.

Indian crypto exchange CoinDCX admitted it lost 15.99 million USDT, worth about $16 million, in an attack targeting deposit wallets that had been discontinued after a cyberattack in July 2025. The confirmation came just days after co-founder and CEO Sumit Gupta said on X that reports of a system breach were likely a “false alarm.”

In a blog post early Sunday, CoinDCX said it had detected unusual activity on Tuesday affecting legacy wallet infrastructure that had unidentified security vulnerabilities. According to the exchange, an automated service that swept and transferred funds between wallets had experienced an issue for a period of time, causing user deposits to accumulate at an address that was no longer in use. CoinDCX said the company would fully cover the losses, user assets remained safely stored in cold wallets with multi-layer custody, and trading, deposits, and withdrawals continued as usual.

From Denial to Acknowledgment

Suspicious transactions were first flagged by Darcy, co-founder of asset recovery support firm FlashRescue, at 1:30 a.m. ET on Wednesday. According to Darcy, around 15.99 million USDT and 5,783.81 TRX were transferred from CoinDCX’s hot wallet and several deposit addresses at 11:35 a.m. on Tuesday, consolidating in a single address on the Tron network. The largest transaction was worth 15,819,002 USDT. The funds were then split up and transferred to deposit addresses on Binance, OKX, and Gate.

Less than three hours later, Gupta dismissed the reports, saying that CoinDCX’s wallets had not been compromised. According to him, those addresses had been taken over in July 2025 and the hackers were merely reusing them. The exchange’s official account also called the allegations misleading. However, on-chain data analyst ZachXBT quickly pushed back, pointing out that a deposit address had remained in use by a liquidity provider for 10 months after the incident, and had even automatically forwarded user deposits to CoinDCX’s current hot wallet in April and May 2026. According to ZachXBT, this showed that the exchange’s team had failed to monitor and properly account for deposits worth $15.8 million.

By 7:47 a.m. on Wednesday, CoinDCX acknowledged that a problem with its automated fund transfer process had caused operational losses, but did not disclose a specific figure until its post on Sunday. ZachXBT later advised users to withdraw their assets from the exchange, saying that its founders had either lied or were seriously incompetent. Nevertheless, he helped CoinDCX freeze stolen assets worth up to hundreds of thousands of dollars.

The latest loss adds to the approximately $44 million lost in the July 2025 attack. At the time, Bengaluru police said hackers had impersonated recruiters to trick one of the exchange’s software engineers into installing malware on a company computer. In March this year, Gupta and co-founder Neeraj Khandelwal were arrested by Indian police in connection with a fraud complaint that CoinDCX said originated from a fake website impersonating the exchange.

The incident came a year after Coinbase invested in CoinDCX at a valuation of $2.45 billion, according to Gupta. When The Block sought comment, a CoinDCX media representative referred it to the blog post and declined to comment further.