India-based crypto exchange CoinDCX said it would cover the loss after confirming that approximately $16 million had been lost from its old wallet infrastructure, days after its CEO described reports of an attack as a “false alarm.”
According to The Block, the exchange reported in a blog update published Sunday that it had lost 15.99 million USDT. The company said the incident affected security vulnerabilities in wallet infrastructure that had been retired after the 2025 attack.
How did funds accumulate in an unused address?
According to CoinDCX, an automated transfer service that moved funds between wallets was down for a period of time. As a result, users’ deposits accumulated at an address the exchange said it no longer used. The company said it covered the resulting loss with its own funds.
The exchange also said user assets were safe in separate cold wallets and that trading, deposits, and withdrawals were continuing as usual.
On-chain records challenged the initial statement
When the suspicious transfers first came to light, CEO Sumit Gupta said CoinDCX’s wallets had not been compromised and that the incident appeared to be a “false alarm.” The exchange’s account also maintained that the addresses in question had not been used since July 2025.
On-chain analyst ZachXBT, however, said a liquidity provider had continued to use one deposit address after the July 2025 incident. According to the analyst, the same address had transferred user deposits to CoinDCX’s current hot wallet in April and May 2026.
CoinDCX later said its automated transfer process had malfunctioned and that it had covered the operational losses, but initially did not disclose an amount. Sunday’s update put the loss at 15.99 million USDT. The exchange’s public relations representative referred questions about its earlier statements and ZachXBT’s claims to the blog post and did not answer additional questions individually.
It also suffered a $44 million attack last year
CoinDCX lost approximately $44 million in July 2025. Gupta attributed the incident at the time to a server breach, while Bengaluru police said the attackers had posed as recruiters and persuaded a software engineer to run malware on a company computer.
The newly disclosed loss of approximately $16 million reveals the toll of a separate incident targeting the old wallet infrastructure.
Not investment advice.