Indian cryptocurrency exchange CoinDCX admitted that it lost approximately $16 million in a attack on its wallet infrastructure, which contradicts the previous statement of its co-founder, who insisted that reports of the intrusion were "misreports."
The exchange, headquartered in Mumbai, stated in a blog post that $15.99 million USDT was transferred away. The company has taken this loss upon itself and emphasized that customer funds are still safe.
The company stated that the funds were transferred on October 21st on the Tron network, and the incident stemmed from a failure in an internal process. This process was originally intended to empty customer deposits from wallets that had been decommissioned following a larger-scale hacking incident last year.
This revelation has put an end to the awkward situation faced by this exchange in recent days. Previously, when blockchain researchers and Arkham trackers first identified a suspicious outflow of around $16 million, CoinDCX CEO Sumit Gupta refuted on X, claiming that the wallet of CoinDCX “had not been hacked,” and that the addresses in question had already been compromised as early as July 2025. Therefore, this incident appeared to be a “false alarm.”
On-chain investigator ZachXBT raised objections to this claim, pointing out that the affected wallet continued to transfer users' deposits to CoinDCX's current hot wallet until April and May, and urged customers to withdraw their assets.
"If you value your assets, please withdraw all your funds from CoinDCX. Their co-founders are like clowns managing a circus. They deny both publicly and privately that any asset theft has occurred, which is either outright lying or a serious case of dereliction of duty. Later, they disclosed a theft incident involving 16 million US dollars..." ZachXBT stated in a post on October 22nd.
This loss has exacerbated a period of turmoil for one of India's largest exchanges. CoinDCX suffered a hacker attack worth approximately $44 million in July 2025, which the company attributed to a server intrusion. Subsequently, they launched a bounty hunt for the stolen funds, and an employee was also arrested in connection with this incident.
Combining these two incidents, the exchange's losses have approached 60 million US dollars.
The retired wallets involved in this new loss were actually a legacy from the previous intrusion. These addresses are no longer in use, but they continue to receive sporadic deposits. The automatic transfer system failed to clear them, leaving the funds at risk.
CoinDCX has also faced other setbacks this year. The exchange has been accused of fraud and impersonation, which led to a police investigation; meanwhile, after a hacking incident in 2025, its founder denied reports of acquisition negotiations with Coinbase. Coinbase has been independently advancing its expansion in South Asia and the Middle East.
