CoinDCX Absorbs $16 Million Loss Stemming from Internal Process Failure Linked to Retired Wallet

CoinDCX, recognized as India's largest cryptocurrency exchange by trading volume, has publicly announced it has absorbed a significant $15.99 million loss, rounded to $16 million. This substantial financial setback is attributed to an internal operational failure concerning a wallet infrastructure that had been officially retired after a security incident in 2025.

The Mumbai-based exchange initially faced scrutiny following reports from blockchain investigators who flagged approximately $16 million in suspicious outflows from addresses purportedly linked to CoinDCX. In response to these early alerts, CoinDCX's CEO, Sumit Gupta, swiftly dismissed the claims on social media platform X, characterizing them as a 'false alarm.' A spokesperson for the exchange further clarified that the flagged addresses were indeed old, established in January 2025, and had been compromised in a July 2025 hack that cost the exchange an estimated $44 million. Following this previous breach, these addresses were deprecated, and CoinDCX asserted they had not been actively used since, suggesting the reported activity bore no connection to the exchange's current operations.

However, the narrative began to shift when ZachXBT, a well known on-chain investigator, presented counter-evidence. ZachXBT highlighted that at least one of the implicated addresses, identified as TQKJQ, appeared to have been utilized by a liquidity provider as recently as April and May 2026. Importantly, this address was observed sweeping user deposits into CoinDCX's currently active public hot wallet, directly contradicting the exchange's initial denial of ongoing use.

Responding to the mounting evidence and ongoing community concerns, CoinDCX published a blog post on Sunday acknowledging that the TQKJQ wallet was indeed part of its 'old operational wallet infrastructure' and confirmed that the reported loss was directly tied to it. The exchange elaborated that this specific wallet infrastructure had been compromised during the July 19, 2025, security incident and subsequently deprecated. Despite the deprecation, the investigation revealed that some users inadvertently continued to deposit funds into these retired addresses. In standard practice, CoinDCX credited these users' portfolios the moment the deposits arrived in the deprecated wallets. A secondary internal service, commonly referred to as 'sweeping,' was intended to automatically transfer these incoming funds from the deprecated addresses into the exchange's secure, primary operational wallets. Unfortunately, this critical 'sweeping' process failed to execute for a specific period, leading to an accumulation of user deposits within the vulnerable, retired address. This failure, rather than an external hack, is what directly resulted in the absorption of the $15.99 million USDT loss by the company.

CoinDCX firmly assures that all user funds remain secure. The exchange explicitly stated that customer balances, active wallets, and trading systems were unaffected by this incident. User assets are held in segregated cold wallets, which function offline and are protected by multi-layer custody and robust offline security controls. By absorbing the entirety of the $16 million loss, CoinDCX has ensured that its customers bore no financial impact from the internal process malfunction. This commitment to covering losses from operational failures is important for maintaining user trust within the volatile cryptocurrency market.

The exchange also addressed its communication timeline, conceding that it 'could have been more proactive' in disclosing the incident. CoinDCX explained that a 'thorough review of the deprecated infrastructure' was required to fully confirm the sequence of events, and the update was shared only once they had the 'complete picture.' While transparency is essential in the digital asset space, complex investigations can sometimes lead to delays in public disclosure. This incident highlights the delicate balance exchanges must strike between providing immediate updates and ensuring the accuracy and completeness of information before releasing it to the public.

This incident serves as a significant reminder of the intricate operational challenges faced by cryptocurrency exchanges. Managing legacy systems, especially those that have been compromised and deprecated, requires meticulous attention to detail and robust fail-safes. The reliance on automated 'sweeping' services, while efficient, necessitates constant monitoring and auditing to prevent such accumulation of funds in vulnerable or unintended locations. Additionally, it underscores the importance of clear and consistent communication with users regarding correct deposit addresses, reducing the likelihood of funds being sent to outdated infrastructure.

The distinction between an 'internal process failure' and a direct 'hack' is also significant. While the funds were indeed lost, CoinDCX's blog post refrained from categorizing it as another hack. This implies that the loss was due to an oversight or malfunction within their own systems rather than a renewed external attack on the retired wallet. However, the fact that funds accumulated in a wallet previously compromised in a $44 million breach emphasizes the persistent security risks associated with such legacy infrastructure, even when supposedly deprecated. It reinforces the need for exchanges to not only retire compromised systems but also to implement stringent measures to prevent any further interaction with them, both from internal processes and external user deposits.

Ultimately, CoinDCX's absorption of the $16 million loss due to a failed internal 'sweeping' service related to a retired, previously compromised wallet is a testament to the complex operational environment of major crypto exchanges. While user funds were ultimately safeguarded by the exchange's decision to bear the financial burden, the event underscores the vital importance of rigorous internal process management, proactive system monitoring, and transparent communication in maintaining the integrity and trust essential for the burgeoning digital asset industry.

Source: CoinDesk — https://www.coindesk.com/markets/2026/10/26/coindcx-absorbs-usd16-million-loss-from-internal-process-failure-tied-to-retired-wallet