The Indian cryptocurrency exchange landscape is grappling with a significant security failure after Mumbai-based platform CoinDCX confirmed the loss of approximately 15.99 million USDT. This development, which emerged following a period of intense public scrutiny, represents the latest chapter in a series of security challenges for the exchange. The incident, which occurred on October 21, 2026, involved the unauthorized drainage of funds from legacy deposit wallets that were believed to have been deprecated following a previous high-profile breach in July 2025.
The confirmation of the loss marks a stark reversal from the exchange’s initial stance. Shortly after blockchain security monitors flagged suspicious outflows on the TRON network, CoinDCX leadership and its public relations channels dismissed the alerts as a "false alarm." The company had initially maintained that the wallets in question were inactive and that no current user assets were at risk. However, persistent investigation by on-chain analysts, most notably the prominent researcher ZachXBT, eventually forced the exchange to acknowledge that a failure in its automated infrastructure had led to the loss of user deposits that were still being routed to compromised, legacy addresses.
A Chronology of the October 2026 Security Incident
The incident unfolded rapidly on October 21, 2026, when blockchain monitors identified an unusual series of transfers originating from addresses associated with CoinDCX. The total volume of the outflow was approximately 15.99 million USDT, supplemented by a smaller quantity of TRX, the native token of the TRON network.
Within hours of the movement, the largest single transaction—a transfer of roughly 15.82 million USDT—was traced as it moved through various intermediary addresses. Analysts observed these funds being funneled into deposit addresses at major global exchanges, including Binance, OKX, and Gate.io, a common tactic used by malicious actors to obfuscate the origin of stolen digital assets.
In the immediate aftermath, CoinDCX co-founder and CEO Sumit Gupta took to social media platform X to address the growing concerns. Gupta categorically denied that a new breach had occurred, labeling the activity as a misunderstanding of how the exchange managed legacy wallet infrastructure. The official company stance at that time was that the addresses involved had been compromised during the July 2025 incident and had been "retired" since. The exchange asserted that it had not used these wallets in over a year, and therefore, the activity was merely a visual anomaly on the blockchain ledger.
On-Chain Investigators Dispute the Official Narrative
The "false alarm" narrative proved unsustainable as independent investigators began publishing evidence that contradicted the exchange’s claims. ZachXBT highlighted a specific deposit address—identified by the prefix TQKJQ—which appeared to be far from inactive. According to the analyst, this address had been utilized by a liquidity provider as recently as April and May 2026, months after the supposed decommissioning of the old infrastructure.
Data provided by these investigators indicated that this address was still effectively "sweeping" user deposits into CoinDCX’s current public hot wallet and was even receiving gas fees, suggesting a level of active integration that the company had failed to disclose. The realization that CoinDCX’s automated sweeping service—a system designed to automatically migrate funds from deposit addresses to more secure, managed storage—was failing for these specific legacy addresses proved to be the smoking gun. Users who continued to send funds to these deprecated addresses were effectively depositing their assets into a "black hole" that was accessible to the threat actors who held the keys to the legacy infrastructure.
Official Admission and Operational Remediation
Faced with mounting evidence, CoinDCX released a formal update admitting to a critical operational failure. The company clarified that while it had attempted to warn users against using legacy addresses, the automated systems designed to capture those stray deposits had failed to function as intended.
"We acknowledge that despite our efforts to move away from older wallet infrastructure, some users continued to deposit crypto to these addresses," the exchange noted in a follow-up statement. "The automated sweeping service failed, and consequently, funds accumulated in these vulnerable locations were drained."
In a move intended to restore market confidence, CoinDCX confirmed that it had absorbed the full loss of the 15.99 million USDT. The exchange has credited the affected user accounts, ensuring that no individual customer experienced a direct financial loss. The company emphasized that its active, current-generation hot wallets, its internal trading systems, and the vast majority of customer assets held in segregated cold storage remained untouched and secure.
Broader Context: The Legacy of the 2025 Breach
The October 2026 incident cannot be viewed in isolation. It is inextricably linked to the significant security breach that occurred in July 2025, which saw approximately $44 million in assets siphoned from the exchange. That event, which investigations later linked to the social engineering of a staff member, exposed the vulnerabilities of the exchange’s internal operational wallet management.
Combined, the two incidents have resulted in approximately $60 million in total losses for the platform. These events have sparked a broader conversation regarding "wallet lifecycle management." In the cryptocurrency industry, the process of retiring old deposit addresses is notoriously complex. If an exchange fails to properly notify users, or if the back-end infrastructure remains partially linked to the live environment, it creates a persistent attack vector.
Industry Implications and Future Outlook
The fallout from the CoinDCX incident has triggered a wave of concern among industry stakeholders. The delay between the initial denial and the eventual admission of a technical failure has drawn criticism from security experts who argue that transparency is the primary currency of trust in the decentralized finance space.
"When an exchange issues a blanket denial in the face of on-chain evidence, it undermines the very premise of the blockchain’s transparency," noted one industry consultant. "The goal should always be an immediate, fact-based investigation, not an attempt to manage public perception before the facts are fully understood."
For CoinDCX, the path forward involves a rigorous audit of its remaining legacy infrastructure and a total overhaul of its communication protocols during security alerts. The exchange has pledged to conduct a full review of its systems and has urged users to strictly adhere to the deposit addresses currently displayed on their official, secure platform interface.
As the crypto industry continues to face sophisticated threats—from social engineering to advanced wallet exploits—the CoinDCX case serves as a stark reminder of the "hidden" risks in legacy systems. The incident highlights that it is not enough to secure new assets; companies must also ensure that every deprecated piece of code or legacy address is truly and completely siloed from the active ecosystem.
Looking ahead, users are advised to remain vigilant. The recommendation from analysts like ZachXBT—to exercise caution and potentially withdraw funds when an exchange exhibits inconsistencies in its security reporting—reflects a growing trend of "self-custody-first" mindsets among retail investors. Whether this incident results in a long-term decline in trust for the Mumbai-based giant remains to be seen, but it has undoubtedly set a new benchmark for what is expected in terms of incident response and accountability in the Indian digital asset market.
Ultimately, the resolution of the incident—with the company absorbing the loss—is a positive sign for the protection of retail users. However, the operational failure that allowed a previously known vulnerability to be exploited twice remains a point of concern that will require sustained, transparent reporting from CoinDCX as it works to secure its remaining infrastructure.
