CoinDCX Confirms $16M Loss Three Days After CEO Called It a False Alarm
CoinDCX confirmed a 15.99 million USDT loss on October 25, three days after co-founder and CEO Sumit Gupta publicly called reports of suspicious outflows a false alarm. Combined with the July 2025 hack, the exchange has absorbed nearly $60 million in losses across 15 months.
India's largest crypto exchange absorbed another $16 million drain tied to its 2025 hack infrastructure, raising the combined loss total to nearly $60 million in 15 months.
Key takeaways
- CoinDCX confirmed a 15.99 million USDT (~$16M) loss on October 25, three days after co-founder and CEO Sumit Gupta publicly dismissed reports of suspicious outflows as "a false alarm."
- The drain exploited a failed automated deposit-sweeping service that left user funds accumulating in a wallet address compromised during CoinDCX's July 2025 hack; on-chain investigator ZachXBT showed at least one address remained active through April and May 2026, directly contradicting the "retired wallet" explanation.
- Tether froze $2.21 million of the stolen funds and roughly $9.63 million has been traced to major exchanges, but CoinDCX has published no proof of reserves and its combined losses across two incidents now stand at nearly $60 million.
CoinDCX, described widely as India's largest crypto exchange by trading volume, confirmed on October 25 that 15.99 million USDT was drained from wallet infrastructure it claims it retired after a prior hack, and that the company absorbed the loss. That confirmation came three days after co-founder and CEO Sumit Gupta told users there was nothing to worry about.
The gap between those two moments is the story.
The Denial, Then the Disclosure
On October 21, roughly $16 million moved out of 40 TRON addresses linked to CoinDCX, all swept to a single newly created address (TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT, per Bitquery's on-chain analysis). The next day, blockchain researcher Darcy, CMO of Salus, flagged the outflows publicly.
Gupta responded on X on October 22, calling the reports "incorrect" and saying the addresses belonged to the July 2025 hack. Multiple sources, including CoinDesk and crypto.news, attribute the "false alarm" characterization to Gupta personally on his @smtgpt account that day. The official CoinDCX account labeled coverage "misleading."
On-chain investigator ZachXBT pushed back the same day, citing specific evidence:
"CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet."
ZachXBT added: "They publicly and privately denied a theft of its assets occurred meaning they straight up lied or are negligently incompetent."
Three days later, CoinDCX published a blog post confirming the loss. The post states the incident "had impacted our old, deprecated wallet infrastructure which had unknown vulnerabilities" and that an automated sweeping service "had failed for a particular period," allowing deposits to accumulate in the compromised address. The company says all customer balances in segregated cold wallets were unaffected. "This led to a loss of 15.99 million USDT, which was absorbed by the company."
Bitquery's independent investigation adds a detail that complicates the "deprecated" framing: CoinDCX's own systems were sending TRX gas to those addresses the morning of the drain. That corroborates ZachXBT's finding that the TQKJQ address was not dormant.
What the On-Chain Record Shows
The arithmetic of the two incidents is straightforward. The July 2025 hack cost approximately $44 million, a figure cited consistently across multiple outlets covering the incident. This October drain cost another $15.99 million. Combined losses: nearly $60 million in 15 months.
Of the October funds, Tether froze $2.21 million, roughly 14% of the total. About $9.63 million has been traced to major exchanges including OKX, Binance, and Gate.io, per Bitquery's on-chain investigation. The remaining ~$4.15 million is unaccounted for in public traces.
The mechanism here deserves a plain reading. When an exchange retires a wallet address, user deposits can still occasionally arrive at that old address. An automated sweeping service is supposed to detect those stray deposits and forward them into the exchange's active, secure infrastructure. If that service breaks silently, deposits pile up in a vulnerable address. That is precisely what CoinDCX describes. The address wasn't empty because the sweep process failed. Someone eventually noticed.
The contested question, which the on-chain record does not fully resolve, is whether CoinDCX knew the address remained active. The exchange says it was deprecated. ZachXBT and Bitquery's data say otherwise. That dispute is material and remains open.
What the "We Absorbed It" Claim Actually Means
"The company absorbed the loss" is being presented as a reassurance. It is also a solvency claim.
CoinDCX is asserting it had sufficient reserves to cover $60 million in losses across two incidents without touching customer balances. That may be true. There is no way to verify it. The exchange has not published proof of reserves. No third-party audit has been disclosed. The regulatory disclosure timeline to FIU-India or CERT-In has not been confirmed publicly.
The structural problem with custodial exchanges is that this opacity is the default, not the exception. A customer's app balance is credited the moment a deposit hits an address. Whether that address is actively swept, dormant, or compromised is invisible to the user. The green number looks the same either way. Prior incidents in the industry have illustrated the same dynamic: the failure is silent until it isn't. The same custody gap that makes exchanges convenient makes losses like this possible.
The falsifiable version of the concern here: if CoinDCX publishes a credible, third-party-audited proof of reserves confirming full 1:1 backing of all customer liabilities before and after both incidents, with complete wallet inventory and sweep-audit logs, and if the on-chain record unambiguously shows TQKJQ was genuinely inactive from August 2025 onward, the solvency concern weakens substantially. As of publication, none of that exists.
What Comes Next
CoinDCX says it is working with exchanges and law enforcement to recover remaining funds. The Tether freeze covers a fraction of the total. Whether the exchange pursues a public post-mortem with verifiable reserve data, or whether this follows the pattern of the July 2025 hack (absorbed, acknowledged, never fully autopsied), is the question worth watching. Users holding balances on Indian exchanges without a published proof-of-reserves should treat that silence as a data point.
Sources
- CoinDCX official blog post, October 25, 2026
- ZachXBT (@zachxbt), X, October 22, 2026
Frequently Asked Questions
What caused the CoinDCX $16 million loss in October 2026?
An automated deposit-sweeping service failed, leaving user deposits accumulating in a wallet address that CoinDCX claims was retired after its July 2025 hack. That address retained an unknown vulnerability from the earlier compromise. When enough funds had accumulated, they were drained. On-chain evidence from ZachXBT and Bitquery indicates the address was still actively interacting with CoinDCX's current hot wallet as recently as May 2026, contradicting the exchange's characterization of it as fully deprecated.
How do the July 2025 and October 2026 CoinDCX incidents connect?
The wallets drained in October 2026 were originally compromised in CoinDCX's July 2025 hack, which multiple outlets reported cost the exchange approximately $44 million. The exchange says it retired those addresses after that incident. On-chain data shows at least one of those addresses continued receiving user deposits and gas payments through April and May 2026, ten months after the first hack. The failed sweep service allowed funds to accumulate there long enough to be drained a second time.
Did CoinDCX customers lose money?
CoinDCX says no customer balances were affected and that it absorbed the 15.99 million USDT loss from company reserves. The exchange states customer funds are held in segregated cold wallets. That claim has not been independently verified through proof of reserves, and no third-party audit has been published.
