India's CoinDCX said an automated process failed, letting customer deposits pile up in old addresses compromised in July 2025. It absorbed the loss of 15.99 million USDT and said customer balances were unaffected.
An exchange can retire a compromised wallet. Getting customers to stop sending money to it is harder.
India's CoinDCX said it lost 15.99 million USDT, about $16 million, from deposit addresses belonging to old wallet infrastructure that was compromised in a security incident it reported on July 19, 2025, and later deprecated. The exchange said its automated sweeping service, which moves incoming deposits out of those addresses, "had failed for a particular period," so customer deposits accumulated where an attacker could reach them.
"This led to a loss of 15.99 million USDT which was absorbed by the company," CoinDCX said. It said customer deposit balances, active wallets and trading were unaffected, and added: "We could have been more proactive."
The reversal
The disclosure came days after the exchange's chief executive, Sumit Gupta, said early reports of a breach sounded like "a false alarm." CoinDCX said it noticed unusual activity on Oct. 21. Its update was dated Oct. 25.
Blockchain investigator ZachXBT criticized the initial denial and alleged that a compromised address had been used to sweep deposits as recently as April and May of this year.
Why it matters beyond one exchange
The loss is not a new hack of live systems. It is an operational failure that left a known-compromised address exposed more than a year after the original breach. That is a distinct risk, and possibly a more common one.
When an exchange rotates its wallets after a breach, old deposit addresses do not disappear. Users who saved them, automated payment systems and third-party services can keep sending funds there. If the process that moves those funds to safety fails, the exchange is exposed to the same attacker again.
For investors, the question is how much value sits in retired but still-funded addresses across the industry, and how exchanges disclose losses when they occur.
Two readings
One reading is that this is a contained operational loss. The company absorbed it, customer balances were untouched, and it has acknowledged the failure publicly.
The other is that the episode shows a remediation and disclosure problem. A breach from July 2025 was still producing losses in October 2026, the first public response was a denial, and outside investigators allege the exposure lasted months.
What to watch
Whether CoinDCX publishes a fuller account of the timeline, any notice to Indian regulators or law enforcement, whether the drained funds can be traced or frozen, and whether other exchanges audit their deprecated addresses.