CoinDCX Admits Losses After $16M Wallet Transfers

CoinDCX loss admission changes its initial account

The acknowledgment followed a more categorical initial company statement. CoinDCX first said the flagged addresses were created in January 2025, compromised that July and unused by the exchange since, describing the reported activity as unconnected to its current operations.

Its later explanation supplied a consequential distinction: although the addresses had been deprecated, customers still sent funds to them, and CoinDCX had an operational process to collect those deposits. The company said it identified the failure on the morning of October 22.

Sweeping means moving deposits from individual receiving addresses into another wallet for accounting or safekeeping. An address can remain capable of receiving blockchain transfers even after a platform removes it from its supported deposit instructions. Retiring an address in an app does not erase it from the network.

CoinDCX did not disclose when the sweeping failure began, why it occurred or how long deposits remained exposed. Its statement also did not provide a transaction-by-transaction reconciliation connecting the failed process to each transfer researchers identified.

The July 2025 breach involved about $44 million, according to Cointelegraph’s account of the earlier incident and latest disclosure. CoinDCX said then that the affected liquidity account was separate from customer wallets and that its treasury would absorb the loss.

The fresh development is therefore an admitted operational loss tied to continued deposits after that compromise, rather than a routine update to the original theft tally. The available statements do not establish a new compromise of today’s active wallet keys.

Researchers trace nearly 16 million USDT

Darcy’s initial report identified approximately 15.99 million USDT and 5,783.81 TRX moving to a TRON address beginning TAg6SZ. The researcher described the movement as suspected theft and said funds were subsequently split among other addresses.

The largest reported transfer was 15,819,002 USDT. An Arkham transaction screenshot published by ZachXBT shows an approximately 15.819 million-USDT movement dated October 21 at 15:35:54 from an address labeled CoinDCX Deposit, beginning TQKJQ, toward the TAg6SZ address.

That screenshot also displays May 2026 interactions with labeled CoinDCX hot wallets. ZachXBT alleged that the deposit address remained in use by a liquidity provider for about 10 months after the July incident, questioning the accounting for roughly $15.8 million in deposits.

The screenshot supports the existence of the displayed transfer record, but does not independently establish the purpose of every transaction or who controlled every address. Wallet labels and researcher conclusions require attribution, especially when the exchange disputes their implications.

In a subsequent tracing post, Darcy listed approximately 2.02 million USDT reaching Binance-linked addresses, 5.52 million reaching OKX-linked addresses and 1.39 million reaching Gate-linked addresses. Those amounts total about 8.93 million USDT and describe a subset of the reported movements, not an additional loss.

Neither the transfer trail nor exchange destinations demonstrate that funds were frozen or returned. No independently verified victim tally, reimbursement audit or additional attack wave was established in the material reviewed by publication.

Separating gross movement, recovery and residual exposure is essential. The Tectonic rollback accounting illustrated how a large incident total can differ substantially from the amount ultimately unrecovered. CoinDCX has not supplied an equivalent reconciliation.

CoinDCX users await deposit reconciliation

CoinDCX says it credited affected users even when deposits went to deprecated addresses. An account credit records what the platform owes a customer; independent evidence of backing and successful withdrawals would provide a fuller picture than that assurance alone.

The exchange advised users to verify deposit addresses through its official app or website before sending funds. Its statement did not set out a new compensation application, a claims deadline or a separate recovery procedure.

The episode highlights the operational boundary between receiving crypto and protecting it after receipt. The expansion of institutional custody services concerns safekeeping arrangements, while this dispute also involves address retirement, deposit monitoring and reconciliation before funds reach cold storage.

Broader sentiment remained positive: Alternative.me’s Bitcoin-focused Fear & Greed Index read 68, or Greed, for October 22, versus 63 a day earlier. It does not measure CoinDCX solvency or the security of any particular exchange.

Source: Alternative.me. The index primarily measures Bitcoin sentiment.

The next material disclosures are the exact loss, the failed process’s duration, the number of affected deposits and evidence of recovery or independent reconciliation. Until those appear, the supported account is that CoinDCX admitted and absorbed operational losses while researchers identified roughly $16 million in overlapping transfers and deposit-accounting questions.