Indian cryptocurrency platform CoinDCX has verified a $15.99 million financial loss tied to legacy wallet architecture, just days after Chief Executive Officer Sumit Gupta brushed off reports regarding unusual outflows as potentially a false alarm. The platform explained that a breakdown in an automated transfer mechanism caused user deposits to build up within vulnerable addresses, noting that the business took on the financial hit itself.
TL;DR
- $15.99 million loss confirmed: CoinDCX says the loss involved 15.99 million USDT linked to old wallet infrastructure.
- Earlier response questioned: The confirmation followed public scrutiny of suspicious transactions and the exchange’s initial denial.
- Customer balances reportedly unaffected: CoinDCX says active wallets, trading systems and customer balances were not affected.
What CoinDCX Says Happened
CoinDCX stated that the impacted addresses formed part of operational wallet systems that were breached in a July 2025 security event resulting in an estimated $44 million loss for the business.
As outlined by the firm, some users kept sending deposits to decommissioned addresses following that prior event. CoinDCX noted that while those deposits reflected properly in user portfolios, a separate automated function was intended to sweep the funds over to main wallets.
That transfer mechanism broke down for a spell, letting deposits pile up inside the legacy infrastructure. CoinDCX ultimately verified that 15.99 million USDT vanished and reported that the organization covered the monetary damage.
The trading platform has not publicly identified who directed the unauthorized transfer of assets or provided a complete technical breakdown of how the shortfall transpired.
Why the Initial Response Drew Scrutiny
This disclosure came on the heels of findings from blockchain analysts who spotted abnormal outflows originating from addresses connected to CoinDCX. Gupta initially pushed back against allegations that the movement signaled a fresh breach, labeling the claims a false alarm.
On-chain sleuth ZachXBT disputed the company’s reasoning, highlighting transaction data indicating that at least one of the contested addresses had continued taking in deposits through 2026.
CoinDCX subsequently admitted to the financial hit and offered an alternative rationale focused on the breakdown of its automated transfer workflow.
This timeline prompted doubts regarding the firm’s oversight of deprecated architecture and the promptness of its public messaging. CoinDCX admitted that its internal review required time and stated that it could have shared updates more proactively.
What the Exchange Says About Customer Funds
CoinDCX insists that its live wallets and trading architecture stayed secure and that user deposit balances remain completely accounted for. The enterprise asserts that security controls and intervention tactics stopped the event from impacting ongoing operations.
These guarantees originate directly from the platform and must be viewed separately from independently verified conclusions. The statement fails to spell out every technical nuance of the event or point out who was at fault.
The situation underscores a wider operational hazard: decommissioning a wallet fails to entirely remove risk if clients retain the ability to transfer assets to that destination or if old keys and systems stay vulnerable.
For more industry context, readers can explore Bitcoinist’s cryptocurrency reporting and its blockchain coverage.
Security Lessons for Crypto Exchanges
Exchanges must account for outdated deposit addresses, private-key exposure, automated transfer failures and unusual transaction patterns. Monitoring systems should identify when funds accumulate in unexpected locations and trigger timely investigation.
The CoinDCX website provides the company’s official information. Its public incident explanation should be read alongside independent reporting when assessing the timeline and unresolved technical questions.
CoinDCX’s confirmation shifts the narrative from an argument over questionable activity into a verified monetary loss. Unresolved issues regarding the underlying trigger, legacy wallet safeguards, and the speed of disclosures continue to matter as the sector reviews what happened.
Written by
Yuki Yamamoto
