Crypto Exchange in India Suffers $16M Loss After Internal Wallet Process Error

CoinDCX has revealed that a failure in its internal fund-transfer process led to a $15.99 million loss involving a discontinued wallet. The Mumbai-based cryptocurrency exchange, which initially dismissed reports of suspicious transactions, says it will absorb the loss without affecting customer balances.

The incident first attracted attention last week when blockchain investigators flagged nearly $16 million in transfers from wallets linked to CoinDCX. The exchange initially rejected the concerns, with CEO Sumit Gupta describing the reports as a false alarm on X.

CoinDCX later told CoinDesk that the addresses in question were created in January 2025 and compromised during a security breach in July 2025. That incident reportedly cost the exchange about $44 million. The company said the affected wallets had been retired and were no longer in active use.

However, blockchain investigator ZachXBT raised questions about that explanation. He identified one address, TQKJQ, which he said was still being used by a liquidity provider. According to ZachXBT, the address had transferred user deposits to CoinDCX’s current public hot wallet in April and May 2026.

In a blog post published Sunday, CoinDCX confirmed that the address was part of its legacy wallet infrastructure. The company reiterated that the wallet had been compromised during the security incident it reported on July 19, 2025, and was subsequently decommissioned.

The exchange explained that certain customers continued sending deposits to the retired addresses after they were taken out of service. CoinDCX said it credited those deposits to the relevant customer accounts as soon as the funds arrived.

A separate system, called “sweeping,” was designed to transfer the deposited assets from the old addresses into the exchange’s main wallet. However, the process did not function correctly during a specific period, preventing some funds from reaching their intended destination.

CoinDCX said the resulting shortfall totaled 15.99 million USDT, which the company has agreed to cover.

The exchange’s statement did not classify the incident as a fresh hack or explain exactly how the irregular transfers occurred. It also did not identify who was responsible for the movement of funds. CoinDesk contacted CoinDCX to ask whether the retired wallet addresses had been compromised again.

CoinDCX maintained that customer assets remain protected in segregated cold wallets, supported by multiple custody layers and offline security measures. Because cold wallets are kept offline, they are designed to limit exposure to internet-based attacks.

The company added that it needed time to investigate its retired wallet infrastructure and reconstruct the sequence of events. It acknowledged that a more proactive response would have been preferable but said it released its explanation after completing the review and establishing a clearer picture of the incident.