India’s largest cryptocurrency exchange platform, CoinDCX, has confirmed a loss of $15.99 million after an internal process failed to move customer deposits out of retired operational wallets that were compromised in a 2025 security incident.
In a disclosure statement, CoinDCX states that it has absorbed the entire loss and assured users that active wallets and trading systems remain secure.
The incident involving the Mumbai-based exchange portrays the growing complexity of wallet‑management infrastructure and the risks exchanges face when legacy systems are not fully decommissioned.
A Loss Rooted in Legacy Infrastructure
CoinDCX’s announcement followed a week of speculation triggered by blockchain investigators who flagged approximately $16 million in suspicious outflows from addresses linked to the Mumbai‑based exchange.
Initially, CoinDCX dismissed the reports as a false alarm, with CEO Sumit Gupta stating on social media platform X that the flagged addresses were old and unrelated to current operations.
But further analysis revealed that at least one of the retired wallets, labeled TQKJQ, had continued receiving user deposits as recently as April and May 2026.
The wallet belonged to CoinDCX’s old operational infrastructure, which was compromised during a July 2025 hack that cost the exchange roughly $44 million. After the breach, CoinDCX deprecated the affected addresses, but some users mistakenly continued sending funds to them.
CoinDCX credited user balances immediately upon detecting deposits to the retired wallet, relying on a secondary “sweeping” service to move funds into the primary hot wallet.
It was this sweeping process that failed for a specific period, causing deposits to accumulate in the deprecated address and ultimately resulting in the $15.99 million USDT loss.
Not a New Hack, but a Process Failure
CoinDCX emphasized that the incident was not a new hack. The exchange stated that the irregular fund movement was tied to the previously compromised wallet infrastructure and that the sweeping failure caused the loss, and not external exploitation.
The company reiterated that all user funds remain safe in segregated cold wallets protected by multi‑layer custody and offline security controls.
Cold wallets, by design, remain offline and are insulated from operational‑layer vulnerabilities. CoinDCX stressed that active wallets, customer balances, and trading systems were not affected, and that the sweeping failure only impacted deposits mistakenly sent to retired addresses
Observed Significance of On‑Chain Investigators
The incident came to light after well‑known on‑chain investigator ZachXBT identified activity involving the retired wallet.
ZachXBT found that the TQKJQ address had been used by a liquidity provider to sweep deposits into CoinDCX’s current hot wallet months after the wallet was supposedly deprecated.
The investigator’s discovery contradicted CoinDCX’s initial claim that the flagged addresses were inactive and unrelated to current operations. The exchange later acknowledged that the wallet belonged to its old infrastructure and that the sweeping failure caused the loss.
The episode shows the growing role of independent blockchain analysts in monitoring exchange activity and identifying operational anomalies before they escalate.
Lessons for Exchanges: Decommissioning Must Be Absolute
CoinDCX’s loss leaves a critical operational lesson for exchanges: decommissioning legacy wallet infrastructure must be absolute, and fallback processes must be continuously monitored.
Even when an address is retired, user behavior may not immediately adjust. Some customers may rely on saved addresses, old deposit instructions, or automated scripts that continue sending funds to deprecated wallets.
In such cases, exchanges must ensure that:
- Deprecated addresses are fully disabled
- Sweeping services are monitored in real time
- Alerts are triggered when deposits reach retired wallets
- User interfaces clearly warn against using old addresses
CoinDCX acknowledged that it could have disclosed the incident sooner and that reviewing the deprecated infrastructure took time. The exchange has committed to strengthening monitoring and communication protocols.
