CoinDCX has put a nearly $16 million price tag on a wallet incident its CEO initially dismissed as a false alarm.

The Indian exchange confirmed the loss in an October 25 update. It says the missing 15.99 million USDT came from retired infrastructure. The company says it has absorbed the cost and customer balances remain unaffected. Those assurances come from CoinDCX, rather than an independent assessment of its reserves.

The public reversal is a central part of the story. According to The Block, CEO Sumit Gupta initially rejected breach reports before the exchange acknowledged losses. Blockchain investigator ZachXBT challenged that account. The publication connects the affected infrastructure to CoinDCX's roughly $44 million hack in July 2025. That history makes the distinction between retiring a wallet and eliminating its remaining exposure especially important.

How a retired wallet still held money

In its official update, CoinDCX dates unusual activity to October 21 and irregular fund movement to the following day. It says some users continued depositing to old addresses. Customer accounts received credits when those transfers arrived. A separate sweeping process was supposed to move the tokens into secure wallets. The company says that process failed for a period, allowing funds to accumulate.

That explanation separates two things customers can easily mistake for the same event. A balance appearing in an exchange account does not, by itself, demonstrate that the underlying tokens have reached their intended storage location. Here, the exchange describes a gap between crediting balances and moving assets. Closing that gap requires operational controls as well as instructions to use new addresses. Calling infrastructure retired offers little comfort if it can still receive valuable deposits.

The questions the loss leaves behind

CoinDCX says trading, deposits and withdrawals continued normally. It also says user assets are held in separate cold wallets and acknowledges that its communication could have been more proactive. The update does not establish who carried out the theft. Nor does a statement about uninterrupted services independently resolve the security investigation. Customers need a clear account of the failed process, the length of the exposure and the checks introduced to prevent a repeat.

For users making another deposit, the exchange's immediate instruction is to check the current address in its app or website every time. An address saved from an earlier transfer can outlive the system that was meant to handle it. The broader issue is whether CoinDCX can demonstrate that obsolete infrastructure no longer leaves money exposed. Its promised absorption of the loss addresses who pays for this incident. A detailed explanation of the controls that failed would address why customers should expect a different outcome next time.

---------------

Author: Ren Nakamura
Asia Newsroom
Breaking Crypto News

Subscribe to GCP in a reader