CoinDCX Hack: 15.99 Million USDT Lost, Initially Called a False Alarm

The CoinDCX hack case became clearer after the Indian exchange acknowledged losing 15.99 million USDT, or approximately US$16 million. A few days earlier, CEO Sumit Gupta had described reports of suspicious transactions as a possible false alarm.

In its clarification, CoinDCX linked the loss to an old wallet and a disruption in its deposit-transfer system. The company said it would absorb the loss and that user balances were unaffected, but the explanation still raises questions about oversight of infrastructure that had previously experienced problems.

Key Takeaways

• CoinDCX acknowledged the loss on October 25, 2026, after initially disputing reports of a new hack.
• The company said a failure in the deposit-transfer process caused funds to accumulate in an old wallet.
• Funds frozen during the investigation cannot yet be considered returned to the company.

CoinDCX Hack Timeline: What Changed?

The case developed over several days. Reports of suspicious transactions emerged first, followed by an initial denial and then an acknowledgment of the loss.

October 21: Suspicious Activity Detected

CoinDCX said it detected unusual activity on October 21, 2026. On the same day, blockchain tracking recorded transfers from several addresses associated with the company on the TRON network.

The findings prompted an examination of the wallets involved. Investigators focused on the source of the funds, address activity history, and transfer destinations.

October 22: Sumit Gupta Says It May Be a False Alarm

Sumit Gupta explained that the flagged addresses had been affected by a security incident in July 2025. He suspected that the attacker had reused those addresses, making the report sound like a possible false alarm.

This initial explanation did not answer whether the old wallet was still receiving funds. That question became important as its transaction history was examined more closely.

October 25: CoinDCX Acknowledges the Loss

CoinDCX finally announced on October 25 that it had lost 15.99 million USDT. The company explained that further investigation had uncovered an issue with its old wallet infrastructure.

With this acknowledgment, the focus shifted from whether a loss had occurred to its cause and handling. However, the available information is insufficient to conclude that all active CoinDCX wallets were hacked.

Read also: Why JPMorgan Blocks AI Agents from Customer Accounts

How Did Funds Accumulate in the Old Wallet?

According to CoinDCX, some users continued sending assets to old deposit addresses even after the company had provided replacement addresses. Those deposits were processed in two stages.

First, the system credited the user's account balance. Second, an automated service transferred the assets from the old receiving address to the company's main wallet.

CoinDCX said this transfer service had failed, causing funds to become stuck and accumulate. Meanwhile, the balances had already been credited to users' accounts.

What Is Wallet Sweeping?

This transfer process is called wallet sweeping. Its purpose is to consolidate assets from deposit addresses into a destination wallet managed by the platform.

From the user's perspective, a deposit may appear complete once the balance is credited. However, an asset transfer still needs to take place behind the scenes and be reconciled with the accounting records.

If the two processes are not monitored together, a transfer disruption may not be immediately visible in the account interface. Therefore, a successfully recorded balance does not automatically prove that the entire asset-custody process has been completed.

On-Chain Findings Raise Questions About Wallet Status

The on-chain investigation identified 40 affected addresses. Approximately 15.82 million USDT came from a single address that had received 88 deposits.

Tracking also found deposits being processed through some associated addresses on the day of the incident. This means the term “old wallet” cannot automatically be interpreted as an address with no activity.

A blockchain address can still receive transfers even after a company stops recommending it. Removing an address from an app or replacing it with a new one does not automatically prevent someone from sending funds to the previous address.

However, transaction records have limitations. They help show the flow of assets but do not fully explain how an unauthorized party gained access.

Read also: LayerZero Zero Mainnet Launches on November 30: Meet lzATLAS

Are CoinDCX Users' Funds Safe?

CoinDCX said users' deposit balances remained fully accounted for and that the company would absorb the loss. It also said trading, deposits, and withdrawals continued to operate.

This helps explain why an asset loss does not always immediately appear as a reduction in customer balances. An exchange can absorb the shortfall without passing it on to users' accounts.

Nevertheless, a company statement is not the same as the findings of an independent review. A comprehensive assessment requires information about available assets, customer liabilities, and the resolution of the incident.

For users, the relevant questions are whether balances are accurate, transactions can be processed, and there are any notices requiring action. These are more useful than judging a platform's condition based solely on a news headline.

Why Is the 2025 Incident Being Discussed Again?

CoinDCX previously experienced a security incident involving approximately US$44 million in July 2025. The company linked the wallet now under scrutiny to infrastructure affected at that time.

That loss is separate from the October 2026 incident. The two events occurred at different times and involved different amounts, so they should not be treated as a single transaction.

This connection highlights the work required after a system migration. Moving core operations to new infrastructure still leaves a need to handle old addresses, misdirected transfers, and automated processes that continue running.

For platform operators, the end of a migration needs to be clearly defined. Which systems have been shut down, which remain monitored, and when support for previous addresses ends should all be traceable.

Read also: Samsung Solana and USDC Coming Soon to 82 Million Galaxy Devices

Funds Frozen: Has the Loss Been Reduced?

An investigation updated through October 23 reported that approximately US$2.21 million in USDT had been frozen across nine wallets. However, the sources reviewed did not confirm that the funds had been returned to CoinDCX.

Freezing and recovery are different stages. Freezing restricts the movement of assets, while recovery means the funds have been returned through the appropriate process.

Therefore, the frozen amount should not be immediately subtracted from the reported loss to calculate a final figure. The status of the assets must first be confirmed.

Readers should also distinguish between funds that have been traced and funds that have been recovered. Identifying a transfer destination helps an investigation but does not automatically make the assets recoverable.

Three Important Questions After the Clarification

Acknowledgment of the loss provides a clearer basis for understanding the incident. However, more details are needed to assess whether the issue has been fully addressed.

1. How Long Was the Deposit-Transfer System Malfunctioning?

The duration of the disruption helps explain how funds accumulated. This information is also important for assessing whether routine monitoring could detect a process that had stopped.

2. How Did Unauthorized Access Occur?

The sweeping failure explains the accumulation of funds but not the full path by which they were taken. Conclusions about the attacker's access require further security investigation.

3. How Can the Fixes Be Verified?

A useful update should explain changes to controls and the results of testing them. This would allow the public to distinguish planned fixes from measures that have already been implemented.

These questions are part of evaluating the case. The absence of answers in the sources reviewed does not mean the company has not conducted any internal investigation.

Read also: SEC Proposes New Crypto Custody Rules: Key Points

Practical Lessons for Exchange Users

This case is a reminder to retrieve deposit addresses from the app whenever making a transaction. An address that worked previously may no longer be valid.

Before sending assets, verify the token name, network, and destination address. Save the transaction hash so the transfer can be traced if a problem occurs.

When reading security news, pay attention to the date and the latest developments. An initial denial, acknowledgment of a loss, a freeze, and a refund each mean different things.

Personal account security must also be maintained. However, protecting a user's login does not replace the platform's responsibility to secure its wallets and operational processes.

Conclusion

The CoinDCX hack highlights the importance of monitoring old wallets and communicating clearly when an incident occurs. The loss has been acknowledged, while the details of the attacker's access and the recovery outcome still require further explanation.

Use verifiable information to assess developments in the case. If you want to continue exploring crypto, you can sign up for Bittime and learn about the available services to suit your needs.

Bittime is a licensed Digital Financial Asset Trader (PAKD) platform authorized and supervised by Indonesia's Financial Services Authority (OJK) — where you can buy Bitcoin in Indonesia and hundreds of other crypto assets starting from IDR 10,000. Registration is quick and secure, and you can get started today.

Track the USDT-to-IDR conversion and the prices of your favorite crypto assets in real time. Everything is available in one crypto investment app that you can download for free from the Play Store.

Ready to get started? Sign up on Bittime now and put your investment strategy into action on a platform trusted by millions of users in Indonesia.

FAQ

How much was lost in the CoinDCX hack?

CoinDCX acknowledged losing 15.99 million USDT, or approximately US$16 million. The company said it would absorb the loss.

Why did CoinDCX's CEO initially call it a false alarm?

Sumit Gupta initially linked the transactions to addresses affected by the July 2025 incident. He suspected that the attacker had reused those addresses.

Were CoinDCX users' balances reduced?

CoinDCX said user balances were unaffected. This statement comes from the company and is not the conclusion of an independent audit in this article.

What caused funds to accumulate in the old wallet?

According to CoinDCX, the automated deposit-transfer service had failed. As a result, assets sent to the old address were not promptly moved to the main wallet.

Have the frozen funds been returned?

The sources reviewed did not confirm that the funds had been returned. Freezing assets is not the same as recovering funds.