Indian cryptocurrency exchange CoinDCX has confirmed a 15.99 million USDT loss after unusual activity compromised deprecated wallet infrastructure from a prior security incident, reversing earlier public denials by management.
Deprecated Infrastructure and Sweeping Failures
On October 21, CoinDCX detected suspicious activity across its wallet infrastructure. While active systems initially prevented impact to trading routines, a subsequent investigation revealed that an old operational wallet had been exploited.
According to the official update published on October 25, an automated sweeping service had failed over an extended period. As a result, deposits sent by users to legacy addresses accumulated in the deprecated wallet instead of transferring into active storage. This flaw allowed bad actors to extract 15.99 million USDT, a sum the exchange confirmed it has completely absorbed.
Reversal of Initial Executive Denial
The admission comes shortly after public statements made on October 22, 2026, by CoinDCX Chief Executive Officer Sumit Gupta. Responding to blockchain analytics firm Arkham, which flagged roughly $16 million in suspicious transfers, Gupta had dismissed the claims as a false alarm involving hackers reusing old addresses compromised in a July 2025 breach.
CoinDCX reiterated that its active central wallets, user balances, trading engines, deposits, and withdrawals remain completely secure and unaffected. The security breach echoes past industry vulnerabilities where legacy configurations led to operational disruptions or security incidents, similar to past customer data breach disclosures.
Key Takeaways
- CoinDCX absorbed a 15.99 million USDT loss stemming from exploited legacy wallet infrastructure.
- An automated sweeping service failure caused user deposits to accumulate in deprecated addresses created prior to a July 2025 hack.
- CEO Sumit Gupta initially rejected Arkham reports on October 22, 2026, calling the activity a false alarm before official confirmation on October 25.
- Customer funds, spot balances, and active trading operations were not impacted.
Why It Matters
This incident highlights the lingering operational risks associated with legacy exchange infrastructure and automated fund management systems. Even when primary active wallets remain secure, unmonitored deprecated addresses and faulty sweeping scripts can create silent, high-value attack vectors. Although CoinDCX’s decision to absorb the financial loss protects retail depositors from direct damage, the public reversal after an initial executive denial underscores ongoing challenges in real-time incident response and transparent security reporting.
