Indian crypto exchange CoinDCX has now admitted a $15.99 million loss after attackers drained funds from old wallets linked to its July 2025 hack. The confirmation came three days after blockchain investigator ZachXBT first reported the suspected theft.
Meanwhile, CoinDCX co-founder Sumit Gupta initially rejected the claims, saying they were just rumours.
CoinDCX Confirms $15.99M Loss From Deprecated Wallets
In a company announcement, CoinDCX said it detected unusual activity on October 21, 2026, and identified irregular fund movements the following day. Its investigation found that old wallet infrastructure, compromised during the July 19, 2025, incident, still held funds because an automated sweeping service had failed.
The service was designed to move deposits from individual user addresses into secure operational wallets. However, deposits sent to old addresses accumulated on-chain instead of being transferred to the primary wallets.
On October 21, attackers drained 15.99 million USDT and 5,784 TRX across 44 transfers, according to the supplied report. CoinDCX said the company would absorb the loss entirely.
CoinDCX: Rumour, Denial and Acceptance of Loss
In an October 22 post, blockchain investigator ZachXBT said approximately 15.99 million USDT and 5,783.81 TRX had been stolen from CoinDCX-linked wallets. CEO Sumit Gupta initially dismissed the claims as a rumour, saying none of the exchange’s addresses had been affected.
ZachXBT strongly criticised the response, accusing the company’s co-founders of either lying about the theft or being negligently incompetent. He also urged users to withdraw their funds from CoinDCX if they valued their assets.
CoinDCX later confirmed the loss in a company update, saying the funds were drained from old wallet infrastructure compromised during its July 19, 2025, security incident.
Now, the question is why the old wallets still held customer funds despite the security breach.
Why Old Wallets Still Held Customer Funds
Well, after its July 2025 hack, which caused a reported $44 million loss, CoinDCX asked users to switch to new deposit addresses. However, some users and platforms continued sending funds to old wallets.
CoinDCX said it still accepted money sent to old wallet addresses and added it to users’ accounts. It was supposed to move that money to safer wallets using a separate sweeping service.
But when that system failed, the money stayed in the old wallets, where hackers could still reach it.
CoinDCX Says User Funds Remain Safe
Following the announcement, the exchange said affected customer balances had been credited internally and that its active wallets, cold storage, and trading systems were not affected.
CoinDCX also said Tether froze approximately $2.21 million of the stolen funds.
Was this writing helpful?
Story Ends Here
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Read the Next News
Be the first to comment