CoinDCX confirms $16M USDT loss after CEO called breach reports a false alarm
In brief
- CoinDCX confirmed a roughly $16 million USDT loss in its Oct. 25 incident update.
- CoinDCX tied the loss to deposit addresses deprecated since its July 2025 breach.
- Bitquery traced $15.8 million to one deposit address across 40 Tron wallets.
- CoinDCX said it absorbed the loss and customer balances weren't affected.
- The incident update didn't include an audited post-incident balance sheet.
What CoinDCX says happened
CoinDCX's Oct. 25 incident update, as reported by CryptoSlate, says the exchange spotted unusual activity on Oct. 21 and learned of irregular fund movements through blockchain data and community reports on Oct. 22. That afternoon it acknowledged unspecified operational losses. The full figure came on Oct. 25.
The weak point was old infrastructure. Some customers kept sending deposits to addresses that had been deprecated since the July 2025 breach, and CoinDCX credited them right away. The automated service that moves those deposits to current wallets then stopped working for an unspecified period (which left the accumulated funds exposed).
CoinDCX says it absorbed the loss and that customer balances were unaffected.
The exchange said trading and withdrawals continued as normal.
What the on-chain data shows
Bitquery counted 40 Tron wallets tied to the transfers on Oct. 23 and traced $15.8 million to one deposit address. According to Bitquery, one address had received 88 deposits since March 2026, and about $9.6 million moved on to addresses associated with Binance, OKX and Gate. Tether reportedly froze $2.2 million connected to the transfers.
Gupta's denial and the later account don't necessarily conflict. CryptoSlate noted that he'd contested a breach of current wallets, while the loss came through deprecated infrastructure.
Why FTX and Celsius keep coming up
CryptoSlate's analysis set the episode against earlier cases where reassurances came shortly before withdrawals stopped. On Nov. 7, 2022, Sam Bankman-Fried posted that FTX's assets were fine; withdrawals effectively stopped on Nov. 8 after about $6 billion in net withdrawals over 72 hours, and FTX filed for bankruptcy on Nov. 11. Alex Mashinsky told Celsius users on June 10, 2022, that the company had billions in liquidity, and Celsius froze withdrawals on June 12.
Those cases ended in criminal fraud outcomes. A jury convicted Bankman-Fried on Nov. 2, 2023, and Mashinsky pleaded guilty in December 2024 to commodities and securities fraud. CoinDCX's case is a different thing (it's an operational loss the exchange itself disclosed, and no fraud has been established), so the comparison isn't an accusation. The exchange also said withdrawals kept running.
It's still missing pieces, though. The open questions include when the sweeping service failed, how long deposits sat exposed, how the attacker gained control, and whether independent evidence supports the claim that all customer liabilities stayed covered. The Oct. 25 statement included an incident update but didn't include an audited post-incident balance sheet.
Frequently asked questions
How did CoinDCX lose $16 million in USDT?
According to CoinDCX's Oct. 25 incident update, some customers kept sending deposits to addresses deprecated since the July 2025 breach. CoinDCX credited those deposits right away, but the automated service that moves them to current wallets stopped working for an unspecified period, which left the accumulated deposits exposed.
Were CoinDCX customer balances affected by the loss?
CoinDCX said it absorbed the loss and that customer balances weren't affected, and that trading and withdrawals continued as normal. Its Oct. 25 statement didn't include an audited post-incident balance sheet, though.
