Skip to content
Blockchain Posts

exploit

CoinDCX confirms $16M USDT drain from 2025-era wallets after CEO's 'false alarm' call

After CEO Sumit Gupta called the breach reports a 'false alarm,' CoinDCX confirmed about 15.99M USDT and 5,784 TRX left retired Tron addresses tied to its July 2025 hack.

by 4 min read
exploittroncoindcxstablecoinexchange

CoinDCX, India's largest crypto exchange by volume, confirmed in a blog update early Sunday, October 25, 2026 that it lost roughly $16 million from an "old, deprecated wallet infrastructure" — reversing public statements by co-founder and CEO Sumit Gupta, who had told X earlier in the week that the activity "sounds like a false alarm" and "CoinDCX wallets are not breached." The amount matches the on-chain outflow that Darcy of FlashRescue flagged at 1:30 a.m. ET on Wednesday: 15,998,994 USDT (15.99M) plus 5,783.81 TRX.

On-chain trail

  • Funds moved on Tron, out of a hot wallet and a handful of deposit addresses CoinDCX says it had stopped using after its July 2025 hack. Crypto Briefing counted outflows from 40 Tron addresses consolidating into one newly created address.
  • The largest single transfer in the drain was 15,819,002 USDT, per The Block, with onward hops routing deposits to Binance, OKX and Gate accounts.
  • Tether froze about $2.21M in USDT tied to the incident on October 22, per Crypto Briefing.
  • The attack time stamp Darcy published was 11:35 a.m. ET Tuesday, roughly 14 hours before the first public flag.

CoinDCX's own account of what went wrong: its automated sweeping service "had failed for a particular period," so deposits kept arriving at an address the exchange no longer used. The company says it absorbed the loss from internal reserves and that customer balances held in segregated cold storage were untouched.

Timeline of the public response

  • Tuesday, Oct. 20: on-chain outflows begin (11:35 a.m. ET).
  • Wednesday, Oct. 21: Darcy publishes the drain. Gupta posts on X that Darcy's report is "incorrect," says "CoinDCX wallets are not breached," calls the activity a "false alarm" and attributes the moves to attackers reusing old addresses.
  • Thursday–Saturday: CoinDCX acknowledges "operational losses" in short X posts without a figure.
  • Sunday, Oct. 25: a long blog post gives the $15.99M figure, blames the sweeping-service failure, says the loss was "absorbed by the company," and reiterates that user funds in segregated cold wallets are safe.

Attribution and the ZachXBT challenge

CoinDCX attributes the drain to "unknown vulnerabilities" in retired infrastructure and has not named an actor. On-chain investigator ZachXBT disputes the "retired" framing: he says at least one of the addresses CoinDCX now calls deprecated was still interacting with the exchange's current hot wallet in April and May 2026, used by a liquidity provider to sweep deposits for 10 months after the July 2025 incident. ZachXBT accused the co-founders of lying or negligent incompetence in his thread; Crypto Briefing echoed the dispute via Bitquery's labelling.

July 2025 context

The July 2025 hack of CoinDCX's internal liquidity account cost roughly $44 million in USDC and USDT, which Bengaluru police later linked to a social-engineering compromise — attackers posing as recruiters got an engineer to install malware. User funds were not affected at the time, and CoinDCX covered the losses from reserves. Sunday's confirmation is the first time the exchange has described a follow-on loss from that cleanup, 15 months later, on wallets it believed were sidelined.

What to watch

  1. Full address list and on-chain post-mortem. CoinDCX's blog post has the top-line number but no addresses, no transaction hashes and no routing diagram. Darcy, ZachXBT and Bitquery each have partial views. A unified post-mortem would let independent analysts reconcile the "retired" claim against the April–May 2026 activity on at least one of the addresses.
  2. The gap between the sweeping-service failure and detection. Fifteen months between the July 2025 hack and this follow-on drain is a long interval for a decommissioning process. Any internal audit trail or external attestation on the sweep-service health is now a credibility input, not an operational one.
  3. Regulatory response in India. CoinDCX is a FIU-India registered reporting entity; a repeat loss on legacy infrastructure after a widely-reported 2025 breach is the shape of event that invites a formal query.
  4. Tether freezes beyond $2.21M. The current freeze is a sliver of the $15.99M total. Any additional seizure after exchange-level KYT flags at Binance, OKX or Gate will be visible on the Tether blocklist.

Context: executive communications before verification

Gupta's "false alarm" call before CoinDCX's internal review had closed is the sharp edge of this story. The exchange's own confirmed figure, less than four days later, matches the number its CEO publicly disputed. For a jurisdiction where a parliamentary inquiry on exchange banking access and FIU reporting rules both turn on exchange operational transparency, that gap between a CEO's live X post and a company blog's figures is the kind of signal risk desks weight.

Sources:

Related stories