Indian crypto exchange CoinDCX has confirmed a loss of 15.99 million USDT (about $16 million) after an attacker drained deposit wallets that the exchange had retired following its July 2025 hack. The admission was posted in a blog update early Sunday, days after co‑founder and CEO Sumit Gupta told users on X that reports of a breach sounded like a false alarm.
What happened
CoinDCX said it detected unusual activity on Tuesday that "had impacted our old, deprecated wallet infrastructure which had unknown vulnerabilities." An automated sweeping service that moves funds between the exchange's wallets "had failed for a particular period," causing user deposits to accumulate at an address the exchange no longer used. The attacker transferred the accumulated funds, and the exchange stated that the loss "was absorbed by the company" while user funds remain in segregated cold wallets. Trading, deposits and withdrawals continued as normal.
Timeline of the denial and subsequent revelations
- 1:30 a.m. ET Wednesday - Darcy, co‑founder of asset‑rescue firm FlashRescue, flagged suspicious outflows: roughly 15.99 million USDT and 5,783.81 TRX left CoinDCX's hot wallet and several deposit addresses at 11:35 a.m. ET Tuesday. All funds were sent to a single Tron address, with the largest single transfer of 15,819,002 USDT later split to deposit addresses on Binance, OKX and Gate.
- Less than three hours later - Gupta replied to Darcy's post: "Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached," adding that the addresses had been compromised in July 2025 and that "the hackers seem to be re‑using the old wallet addresses and this sounds like a false alarm."
- Four minutes after Gupta's reply - CoinDCX's official X account called the claims "misleading" and noted the addresses "have not been used by CoinDCX since" the July 2025 incident.
- On‑chain analyst ZachXBT later pointed out that one of the deposit addresses "was in use by a [liquidity provider] for 10 months after your July 2025 incident" and had swept user deposits to the current hot wallet as recently as April and May 2026. He concluded that "$15.8 M in user deposits was unaccounted for by your team."
- 5:59 a.m. ET - Gupta responded to ZachXBT, saying the team was "investigating it further" and that "no user funds will be at loss."
- 7:47 a.m. ET - CoinDCX posted that the sweeping failure caused "operational losses, which were absorbed by CoinDCX," without specifying an amount.
- ZachXBT subsequently advised users to "withdraw all funds from CoinDCX if you value your assets," and described the co‑founders as having "publicly and privately denied a theft of its assets, meaning they straight up lied or are negligently incompetent." He also noted that he had helped the exchange freeze stolen crypto worth six figures.
Context and prior incidents
- The July 2025 hack cost CoinDCX about $44 million. Bengaluru police later reported that hackers posing as recruiters tricked a CoinDCX software engineer into installing malware on a company laptop, granting the attackers internal access.
- In March 2026, Indian police arrested Gupta and co‑founder Neeraj Khandelwal over a fraud complaint that CoinDCX said stemmed from scammers impersonating the exchange via a copy‑cat site.
- October 2025 saw Coinbase invest in CoinDCX in a deal Gupta said valued the exchange at $2.45 billion, expanding Coinbase's U.S.‑listed exchange presence in India and the Middle East.
Reactions
When asked about the discrepancy between Gupta's earlier denials and the later admission, a representative for CoinDCX's public‑relations agency referred The Block to the company's blog post and did not provide additional comments.