The company CoinDCX confirmed the loss of 15.99 million USDT as a result of a wallet infrastructure hack, having initially rejected claims that nearly $16 million was stolen from the Indian crypto exchange.
In a statement dated 25 October, CoinDCX acknowledged that the incident, which occurred on 21 October, affected its old operational wallets, which had been decommissioned after a $44 million breach in July 2025.
The exchange said a failure in its automated account top-up system allowed cryptocurrency to accumulate at an address that customers continued to use despite instructions to switch to newer wallets. CoinDCX absorbed the resulting losses and stated that customer balances and active trading systems were unaffected.
CoinDCX shifts its position on the $15.99 million loss
The acknowledgment followed several days of disagreement between CoinDCX executives and blockchain specialists over suspicious transactions involving wallets linked to the exchange.
On 22 October, CoinDCX CEO Sumit Gupta dismissed suggestions of a new security breach, saying the flagged addresses belonged to infrastructure compromised in July 2025. He confirmed that no funds had been moved from currently active wallets to the addresses under scrutiny.
On 22 October, blockchain researcher Darcy identified transfers involving approximately 15.99 million USDT and 5 783.81 TRX on the Tron network.
Gupta suggested that the previous attackers may have reused the compromised addresses, calling these concerns a possible false alarm.
However, the company's latest statement confirms that deposits continued to arrive at the addresses in question and that its own systems were responsible for moving them to secure wallets when the automated service was functioning correctly.
The company said it noticed unusual activity on 21 October, but discovered irregular movements of funds the following day, using on-chain records and community reports.
The company admitted that its communication could have been better. "We could have acted more proactively," the statement said, explaining that the investigation required time to establish the sequence of events.
Why did the hacked CoinDCX wallets keep processing deposits?
The latest details explain why wallets compromised more than a year ago continued to process customer transactions.
According to CoinDCX, some customers kept sending cryptocurrency to previously issued deposit addresses even after the exchange replaced its compromised infrastructure.
Rather than invalidating deposits, the company maintained a refund process under which funds were credited to customers immediately as they arrived.
A separate automated service then transferred the deposited cryptocurrency from the inactive addresses to secure, active wallets. CoinDCX said this arrangement allowed users to access their credited balances without waiting for transfers between wallets to be completed.
However, the company did not disclose exactly when the automated transfer service stopped working, how long the funds had been accumulating, or exactly how outsiders gained access to the money.
Blockchain specialist ZachXBT called into question the claim that the wallets were no longer in use, pointing to an address beginning with TQKJQ.
He claimed that the liquidity provider continued using the address for roughly 10 months after the July 2025 hack, with transactions recorded as late as April and May 2026.
A separate blockchain analysis conducted by Bitquery revealed additional activity. During the investigation, ordinary deposit movements across the affected addresses were tracked until 21 October, and one wallet was found to have accumulated 88 deposits totaling approximately 15.82 million USDT.
The investigation's findings suggest that the wallet infrastructure continued processing transactions even after CoinDCX classified it as shut down, although the investigation was unable to determine how the attacker obtained the private keys.
Read also:
