Indian cryptocurrency exchange CoinDCX says it absorbed a 15.99 million USDT loss after an automated service failed to move deposits out of deprecated wallet infrastructure. The October 25 disclosure gives a fuller account of unusual activity first noticed on October 21 and clarifies why funds were still reaching addresses that the company had retired after a July 2025 security incident. CoinDCX says its active trading and wallet systems continued operating and that customers' credited balances were not reduced.

A recovery process became the point of failure

CoinDCX said some customers continued sending assets to old deposit addresses even after the exchange displayed replacement addresses. Its recovery process separated two steps: users were credited when a deposit reached a deprecated address, and a second service later swept the assets into a primary secure wallet. According to the company, that sweeping service failed for an unspecified period, allowing deposits to build up in the older infrastructure. CoinDCX said unknown vulnerabilities in that infrastructure were then exploited, causing the 15.99 million USDT loss. The company did not say how long the sweeper was unavailable or explain how an unauthorized party obtained control of the relevant keys.

Related reporting: NEAR Intents restores service after $3.8 million cross-chain exploit

The disclosure changes the earlier public account

The update followed several days of disagreement over what the blockchain activity represented. The Block reported that CoinDCX chief executive Sumit Gupta had initially described reports of another breach as a possible false alarm, while the exchange's account said the old addresses had not been used since the July 2025 incident. The new statement acknowledges that deposits continued to arrive there and that CoinDCX maintained a process to credit and recover those funds. CoinDCX also conceded that it could have communicated more proactively while reviewing the sequence of events.

On-chain records add detail, not a complete cause

Bitquery's review of Tron transactions identified 40 affected addresses and about 15.99 million USDT taken on October 21. Its analysis said CoinDCX systems were still moving deposits through some of those addresses on the day of the loss. Bitquery also traced approximately $9.63 million through intermediary wallets to addresses associated with three exchanges and reported that Tether froze about $2.21 million across nine wallets on October 22. Those observations describe transaction paths visible on a public blockchain. They do not, by themselves, prove how the wallet credentials were compromised or identify the person responsible.

What users and exchanges should watch

CoinDCX says customer deposit balances remain fully accounted for, active custody uses segregated cold wallets, and trading, deposits and withdrawals continued without restrictions. It urged users to verify the latest deposit address before every transfer and said it would strengthen monitoring and controls around residual systems. The distinction between customer balances and the company's operational loss matters, but so does the broader control issue: infrastructure labeled deprecated can remain exposed if customers can still fund it and recovery services continue touching it. For customers, the episode also shows why a saved exchange address should not be treated as permanent; checking the address shown inside the official app before each deposit can reduce the chance of funds entering a retired route. The next important disclosures are the duration of the sweep failure, the route by which the keys were accessed, any additional recovery of funds and whether Indian authorities open a formal review.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.