CoinDCX Confirms $16 Million USDT Loss After CEO's 'False Alarm' Claim

Indian cryptocurrency exchange CoinDCX has confirmed it lost 15.99 million USDT, roughly $16 million, after attackers drained retired wallets on the Tron network on Oct. 21. The admission, published in a company blog post, reverses co-founder and CEO Sumit Gupta's earlier public claim that reports of a breach were a "false alarm." The exchange said it absorbed the loss itself and that customer balances remain unaffected — a promise the company has now made twice in fifteen months.

The incident traces back to a failure in an internal process. According to the blog post, CoinDCX had retired the affected wallets following a far larger hack in July 2025, but the addresses continued to receive residual customer deposits. An automated sweeping system, designed to move those funds into active wallets, failed to clear them out, leaving the balances exposed.

What did the exchange say, and when?

The disclosure capped several days of contradiction. When blockchain researchers and the Arkham tracking platform first flagged roughly $16 million in suspicious outflows, Gupta pushed back on X, writing that CoinDCX's wallets were "not breached" and that the flagged addresses had been compromised back in July 2025 — activity he described as looking like a "false alarm."

On-chain investigator ZachXBT disputed that account. He noted the wallet in question had still been sweeping user deposits into CoinDCX's current hot wallet as recently as April and May, undermining the timeline Gupta offered. "Withdraw all funds from CoinDCX if you value your assets," ZachXBT wrote, adding that the co-founders had "publicly and privately denied a theft of its assets occurred meaning they straight up lied or are negligently incompetent."

The denial-then-confirmation sequence matters beyond one exchange. In plain words: an exchange that dismisses an accurate breach report for days forces customers to price in both operational risk and credibility risk.

How large is the cumulative damage?

The new loss compounds a difficult stretch for one of India's largest exchanges. In July 2025, CoinDCX suffered a hack of roughly $44 million, which it attributed to a server breach. That episode prompted a public bounty hunt for the stolen funds and, later, the arrest of an employee in connection with the incident.

Together, the two episodes bring CoinDCX's losses to nearly $60 million in about fifteen months — equivalent to more than $3.8 million per month of disclosed losses across the period. The retired wallets at the center of the new loss were themselves a legacy of the 2025 breach: addresses the exchange had stopped using but never fully emptied of inbound deposits.

The operational lesson is straightforward. Decommissioning a wallet address does not stop customers from sending funds to it, and any wallet that still receives deposits requires active sweeping until inflows demonstrably cease.

What comes next for CoinDCX?

The exchange said it will share further details as its investigation continues and reiterated that user balances are unaffected — though it has not specified what remediation, if any, applies to the failed sweeping process or who bears responsibility for the week of public denial.

CoinDCX has faced other turbulence this year. The exchange confronted fraud and impersonation-scam allegations that drew a police probe, and Gupta denied reports of acquisition talks with Coinbase following the 2025 hack. Coinbase, for its part, has separately moved to expand across South Asia and the Middle East, a competitive pressure that a second breach in fifteen months will do nothing to relieve.

Whether CoinDCX publishes the promised investigative detail — and whether regulators or Indian authorities treat the delayed disclosure as a supervisory concern — remains the open question for the weeks ahead.