CoinDCX says it absorbed $16 million loss after sweeping failure on retired wallet
In brief
- CoinDCX says it absorbed a 15.99 million USDT loss tied to a deprecated wallet.
- CEO Sumit Gupta first called outflow reports a false alarm on X, CoinDesk reported.
- ZachXBT said address TQKJQ swept deposits to CoinDCX's hot wallet in April and May 2026.
- CoinDCX's blog post doesn't call it a hack or say who moved the funds.
From "false alarm" to a $16 million loss
It started last week. Blockchain sleuths flagged about $16 million in suspicious outflows from wallets linked to CoinDCX, and the exchange's first response was that the activity had no connection with it.
A spokesperson told CoinDesk the flagged addresses were old ones (created in January 2025 and compromised in the July 2025 hack, which cost the exchange about $44 million) and that CoinDCX hadn't used them since.
ZachXBT didn't see it that way. The on-chain investigator said at least one of those addresses, labeled TQKJQ, was in use by a liquidity provider and swept user deposits to CoinDCX's current public hot wallet as recently as April and May 2026.
What CoinDCX's blog post says
On Sunday, CoinDCX published a blog post saying TQKJQ belongs to its old operational wallet infrastructure and that the loss was tied to it.
"This wallet belongs to our old operational wallet infrastructure, which was compromised during the security incident we reported on July 19, 2025, and was deprecated as a result"
According to the post, some users kept depositing funds into the retired addresses by mistake after the 2025 incident. CoinDCX credited those users' portfolios the moment the funds reached the deprecated wallet. A secondary process the exchange calls sweeping was supposed to move that money into its primary wallet, but it failed for a period of time, so deposits piled up in the old address. CoinDCX said that led to a loss of 15.99 million USDT, which the company absorbed.
The questions still open
The post doesn't call this a hack. It also doesn't say who was behind the irregular fund movement, or how it happened.
CoinDesk asked CoinDCX whether that means the old, retired addresses were hacked again.
CoinDCX said all user funds remain safe in segregated cold wallets with multi-layer custody and offline security controls. The exchange also said the review of its deprecated infrastructure took time, conceded it could've been more proactive, and said it shared the update once it had the complete picture.
That's a long way from the "false alarm" its CEO posted on X last week.
Frequently asked questions
What caused CoinDCX's $16 million loss?
According to CoinDCX's blog post, some users kept depositing into wallet addresses it retired after its July 2025 hack. The exchange credited those deposits right away, but a sweeping process meant to move the funds into its primary wallet failed for a period, and CoinDCX said it absorbed a 15.99 million USDT loss.
Did CoinDCX say it was hacked again?
No. CoinDCX's blog post doesn't call the event a hack, and it doesn't say who was behind the irregular fund movement or how it happened. CoinDesk asked the exchange whether the retired addresses were hacked again.
