CoinDCX confirms roughly $16M loss after attackers drain retired deposit wallets
In brief
- CoinDCX confirmed a roughly $16 million loss from deposit wallets it had stopped using.
- CoinDCX blamed a failure in its automated sweeping service and said it absorbed the loss.
- Tether froze about $2.21 million in USDT tied to the incident, Crypto Briefing reported.
- The retired wallets were left over from CoinDCX's 2025 hack, an estimated $44 million loss.
What CoinDCX says broke
So what actually went wrong? According to CoinDCX's statement, the problem was its automated sweeping service (the system that moves funds between CoinDCX's own wallets). That service stopped working for a stretch, and while it was down, user deposits kept arriving at an address the exchange wasn't using anymore.
CoinDCX said the service “had failed for a particular period.”
The exchange said it credited affected users from internal reserves. It also said trading operations weren't disrupted.
The on-chain trail
Research findings cited by Crypto Briefing put the outflow at approximately 15.99 million USDT and 5,784 TRX, moved from 40 TRON addresses into a newly created address. Crypto Briefing also reported that on October 22, Tether froze approximately $2.21 million in USDT tied to the incident.
These weren't fresh wallets.
They were left over from the exchange's 2025 hack. On-chain investigator ZachXBT and analytics firm Bitquery flagged that at least one of the TRON addresses stayed active after it was labeled retired. That address reportedly kept interacting with CoinDCX's hot wallet for months after the 2025 hack. The same research findings noted no immediate market-wide price impact on USDT or broader tokens.
Second loss after the 2025 hack
This isn't CoinDCX's first security loss. In July 2025, the exchange lost an estimated $44 million from an internal liquidity account in a hack, and CoinDCX has maintained that customer assets held in segregated cold storage weren't affected.
As with the 2025 incident, CoinDCX says customer balances weren't hit; it describes the new incident as an operational loss covered from its own reserves.
Frequently asked questions
What caused CoinDCX's $16 million loss?
CoinDCX blamed its automated sweeping service, which moves funds between the exchange's own wallets. It said the service failed for a period, and during that time user deposits kept arriving at an address it no longer used. Attackers then drained those retired deposit wallets.
Were CoinDCX customer balances affected by the breach?
CoinDCX said it wasn't a hit to customer balances and called the damage an operational loss. The exchange said it absorbed the loss itself, credited affected users from internal reserves and kept trading running without disruption.
