CoinDCX’s retired wallet still cost $16 million

CoinDCX, India’s largest crypto exchange by trading volume, said it absorbed a $16 million loss after an internal process failed to move customer deposits out of a retired wallet linked to older infrastructure.

The useful number is 15.99 million USDT. The more awkward one is zero: that is how much cash should have been left sitting in a wallet the company says it had deprecated after its July 19, 2025 security incident, which cost about $44 million.

According to a CoinDCX blog post cited by CoinDesk, some users kept sending funds to old deposit addresses even after those addresses had been retired. CoinDCX said it credited those users as soon as the deposits arrived, while a separate “sweeping” process was supposed to transfer the funds into the exchange’s primary wallet. For an unspecified period, that process failed, allowing balances to accumulate in the deprecated address.

CoinDCX said the result was a loss of 15.99 million USDT, which the company absorbed, and added that customer funds remain safe in segregated cold wallets. That matters, but it does not answer the more operational question: why a wallet compromised in 2025 could still become a meaningful holding pen for deposits in 2026.

The company’s explanation also narrows what is proven and what is not. CoinDCX did not describe the incident as a hack in its blog post and did not say who moved the funds or how. CoinDesk reported it had asked whether the old retired addresses had been compromised again.

What is clearer is that the public story changed. After blockchain investigator ZachXBT and other on-chain sleuths flagged about $16 million in suspicious outflows from wallets tied to CoinDCX, chief executive Sumit Gupta dismissed the reports on X as a false alarm, according to CoinDesk. The exchange later acknowledged that activity tied to one of the addresses, known as TQKJQ, came from its old operational wallet setup.

CoinDesk also reported ZachXBT said that wallet had been used by a liquidity provider and had swept user deposits to CoinDCX’s current public hot wallet as recently as April and May 2026. If accurate, that makes “retired” sound less like decommissioned infrastructure and more like a back room no one locked properly.

For an exchange, this is not just a security story. It is a reconciliation story. When a platform credits users before money reaches the place it is meant to reach, process risk stops being back-office trivia and starts costing eight figures.