CoinDCX Loses 15.99M USDT From Decommissioned Wallets

15.99M USDT Drained From Retired CoinDCX Wallets

The damage stopped at the boundary of wallets CoinDCX had already retired. The Indian exchange disclosed on Sunday, October 25 that 15.99 million USDT drained from a cluster of operational wallets it decommissioned after the July 2025 hack, and that it is absorbing the entire loss. Customer balances were not affected. The token at the center is a stablecoin issued by Tether, and the incident never touched the peg: the USDT price, fixed to the dollar, was not part of a drain that moved existing tokens out of dead addresses. The company's official blog lays out the sequence. Internal systems flagged an anomaly on Wednesday, October 21, and the immediate response kept the wallets and trading systems still in production out of harm's way. A day later, on-chain data and user reports surfaced suspicious fund movements, and the investigation traced them to the retired infrastructure, which carried an unknown vulnerability. Those retired wallets were the same group compromised in the breach disclosed on July 19, 2025, when roughly $44.2 million was stolen from an internal operational account used to supply liquidity on partner exchanges. That earlier loss was also covered by CoinDCX, and the affected wallets were pulled from service afterward. Why the USDT sat in dead addresses is a story of user error meeting a cleanup process. Even after the app began displaying new deposit addresses, some customers kept sending funds to the old ones. CoinDCX operated a two-stage rescue for exactly this case: balances were credited the moment a misdirected deposit arrived, and a separate service then swept the funds into the production wallets. In this instance the sweep had been halted for a period, so misdirected deposits accumulated in the retired addresses, and that is what was drained. The largest single outflow was 15,819,002 USDT.

On-Chain Flags Preceded the Denial

On-chain investigators were ahead of the company's public account. Darcy, co-founder of the asset-recovery service FlashRescue, flagged the suspicious transfers on the Tron network, a layer 1 blockchain run on delegated proof of stake, on Thursday, October 22. Sumit Gupta, CoinDCX's co-founder and chief executive, posted on X that same day that the company's wallets had not been breached, urged users not to spread “misinformation,” and described the flagged address as one already compromised in the July 2025 incident that a hacker appeared to be reusing. The exchange's official account called the report misleading. ZachXBT later pointed out that one of the addresses had also forwarded deposits to the current hot wallet in April and May 2026. Gupta responded that the matter was under investigation and that user funds had not been affected, and CoinDCX acknowledged on X the same day that the operational loss caused by the sweep defect was its own to bear. The blog post is the closest thing to a post-mortem. The company said scrutiny of the old infrastructure and reconstruction of the timeline took time, and conceded it “could have moved more proactively.” It is strengthening monitoring of residual systems and plans to make clear to users that old addresses carry an expiry. Trading, deposits and withdrawals, it said, had continued for the preceding 72 hours without suspension or withdrawal limits. The disclosure lands in a crowded stretch for the exchange. In March, Indian police detained Gupta and co-founder Neeraj Khandelwal over a fraud complaint tied to fake CoinDCX sites; the company denied any founder involvement, and a Thane court granted bail within days, finding no evidence to support the charges. In October 2025, Coinbase announced an investment in CoinDCX for an undisclosed sum, with Gupta putting the post-investment valuation at $2.45 billion; India's Competition Commission approved the minority stake that December.

Our reading is that this was a defect in the cleanup process, not a fresh breach of live infrastructure: the mechanism built to rescue misdirected deposits became the attack surface once the sweep stalled, and the scope stops at retired addresses. Anomaly detection on October 21 protected the active systems; what lagged was the company's public account, which denied a breach on October 22 while on-chain investigators were already flagging the Tron transfers. USDT keeps drawing drains of this kind, from a $4.85M USDT drain on an Ethereum project to slower supply-side pressure, with circulating supply contracting as the USDT market cap shed $1 billion in five days; venue risk now deserves as much weight as market risk in any review of the best crypto exchanges. What the sources still describe as exposed is the residual old-address layer: monitoring has been strengthened, users are to be told that old addresses expire, and trading and withdrawals had run for the previous 72 hours without restriction.