CoinDCX, India’s largest crypto exchange by trading volume, has confirmed a loss of $15.99 million after a failure in its internal wallet management process. The company said it would absorb the entire loss rather than pass it on to customers.
The incident came to light last week when on-chain investigators flagged approximately $16 million in suspicious transfers involving wallets associated with the Mumbai-based platform. CoinDCX initially dismissed the reports, with CEO Sumit Gupta describing the claims as a false alarm on X.
At the time, a CoinDCX spokesperson told CoinDesk that the addresses under scrutiny were legacy wallets created in January 2025 and compromised in a security breach that July. The earlier incident reportedly cost the exchange around $44 million. CoinDCX maintained that it had stopped using those addresses and said the newly reported transactions were not connected to its operations.
Blockchain investigator ZachXBT subsequently disputed that account. He pointed to an address labeled TQKJQ, saying a liquidity provider had continued using it and transferring customer deposits to CoinDCX’s current public hot wallet as recently as April and May 2026.
In a blog post published Sunday, CoinDCX acknowledged activity involving TQKJQ and confirmed that the address belonged to its retired operational wallet infrastructure, which had been compromised during the July 19, 2025, security incident.
The exchange said some customers continued depositing funds into the old addresses even after they were decommissioned following the breach. CoinDCX credited the corresponding amounts to users’ accounts when the deposits arrived.
A separate mechanism, referred to as “sweeping,” was supposed to transfer those funds from the retired addresses to the exchange’s main wallet. However, the process failed during a particular period, allowing deposits to remain in the old wallet.
“This led to a loss of 15.99 million USDT which was absorbed by the company,” CoinDCX stated.
The exchange did not classify the latest incident as a hack in its blog post. It also provided no details about who initiated the irregular transfers or how the funds were moved. CoinDesk contacted the company to determine whether the retired wallets had been compromised a second time.
CoinDCX sought to reassure customers that their assets remained protected, stating that user funds are held in segregated cold wallets with multiple layers of custody protection and offline security measures. Cold wallets are designed to remain disconnected from the internet.
The company also explained that its investigation took time because it needed to review the legacy wallet infrastructure and reconstruct the sequence of events. CoinDCX acknowledged that it could have communicated more quickly but said it issued its update once it had established a clearer understanding of what had occurred.
