CoinDCX has confirmed that approximately $15.99 million in USDT was lost from old Tron wallet infrastructure linked to a previous security incident. The exchange says the affected wallets had been deprecated, and that a failed automated sweeping process allowed deposits to accumulate in addresses no longer intended for active use.
The disclosure came after blockchain researchers flagged a large transfer from CoinDCX-linked wallets on October 21, 2026. The incident has raised questions about legacy deposit addresses, wallet monitoring, and the difference between safeguarding user balances and safeguarding every wallet an exchange has used.
CoinDCX Says the Loss Came From Old Wallet Infrastructure
According to CoinDCX’s official explanation, the affected addresses belonged to an operational system compromised during the exchange’s July 2025 security incident. The company said those addresses had been deprecated, but some users continued sending assets to them instead of using the latest deposit addresses shown in the app.
CoinDCX also said an automated sweeping service failed for a period of time. The service was designed to move deposits from individual addresses into the exchange’s operational wallets. When that process stopped working, funds accumulated in the old infrastructure and were later transferred out.
The exchange stated that the loss was absorbed by the company and that active wallets, trading systems and customer balances remained unaffected.
Why the Initial “False Alarm” Claim Created Confusion
Before CoinDCX confirmed the loss, its co-founder and CEO Sumit Gupta described reports of a new breach as a “false alarm.” The exchange initially argued that the addresses had already been compromised in 2025 and were not part of its current wallet system.
That position changed after further investigation. CoinDCX later acknowledged that $15.99 million had been lost from the old infrastructure, although it continued to distinguish the incident from a compromise of its active wallets.
The change in wording matters because users and market participants evaluate security incidents not only by the size of the loss, but also by how quickly and clearly an exchange explains what happened.
On-Chain Evidence Raises Further Questions
The public blockchain record has produced a more complicated picture. Bitquery’s investigation found that some of the addresses involved in the transfer appeared to have processed deposits and received transaction-fee funding after the July 2025 incident.
Bitquery reported that approximately $15.82 million came from one address holding a large number of deposits. It also traced funds to addresses associated with OKX, Binance and Gate. The investigation noted that blockchain data can show wallet activity and transaction flows, but it cannot independently confirm whether specific balances had already been credited to customers’ accounts.
This distinction is important. CoinDCX’s statement focuses on customer balances and the company’s decision to absorb the loss. The on-chain investigation focuses on the continued activity of the addresses and the movement of funds. Both describe different parts of the same event, and a complete conclusion will require additional internal records or an independent.
Tether Froze Part of the Funds
Blockchain investigators reported that Tether froze approximately $2.21 million in USDT linked to the transfers. Other funds were routed through several wallets and reached deposit addresses associated with major exchanges.
A freeze can slow the movement of stolen funds, but it does not automatically mean the assets will be returned. Recovery usually depends on exchange cooperation, law-enforcement requests, wallet attribution and the outcome of any internal or legal investigation.
The movement of funds through several intermediary wallets also demonstrates why the first hours after a crypto incident are critical. Stablecoin issuers, exchanges, blockchain analysts and investigators may need to coordinate quickly before assets are converted, bridged or moved across multiple networks.
The Real Risk Was Not Only the Attack
The most important lesson from the CoinDCX case is the danger of legacy wallet infrastructure. A deposit address may be described as retired, yet it can remain visible on-chain and may still receive funds from users who rely on old records or saved withdrawal templates.
That creates several operational risks. The exchange must identify deposits sent to outdated addresses, maintain enough monitoring to detect unusual balances and ensure that the private keys associated with retired infrastructure are securely removed or isolated. It must also make the transition to new addresses clear enough for ordinary users to follow.
For users, the basic precaution is straightforward: check the current deposit address each time before sending funds. An address that worked previously should not automatically be treated as valid today.
Why This Matters Beyond CoinDCX
Crypto users often focus on whether an exchange keeps most assets in cold storage. That remains important, but the CoinDCX incident shows that the smaller systems around custody can also create material exposure.
Deposit address generation, automated sweeping, hot-wallet funding and legacy-key retirement may appear technical, but they directly influence how customer assets move. A failure in one of these processes can create losses even when the exchange’s main treasury remains offline.
The case is still developing, and the available evidence does not establish every detail. CoinDCX says customer funds remain safe and that it absorbed the loss. Independent on-chain research has challenged parts of the exchange’s initial account. The responsible conclusion is to separate verified transactions from unresolved claims and wait for further evidence.
For readers following exchange security, stablecoin flows and broader crypto market developments, Tapbit Learn provides further market education and research. Users can visit Tapbit, log in, or create an account.
Frequently Asked Questions
Was CoinDCX hacked again in October 2026?
CoinDCX says the incident affected old wallet infrastructure connected to its 2025 security incident rather than its active wallets. Blockchain researchers have described the event as an attack involving CoinDCX-linked addresses. The exact technical classification remains disputed.
How much money was lost?
CoinDCX reported a loss of approximately $15.99 million in USDT. The exchange said it absorbed the loss and that customer balances were not affected.
Did the funds come from user deposits?
CoinDCX said some users had continued sending funds to old deposit addresses after they were deprecated. Bitquery’s investigation found that most of the transferred USDT came from one address holding accumulated deposits, although blockchain data alone cannot confirm how those deposits were reflected in customer account records.
