CoinDCX Confirms $16 Million Cryptocurrency Theft After Dormant Wallet Infrastructure Is Compromised

Indian cryptocurrency exchange CoinDCX has confirmed that approximately $16 million in cryptocurrency was stolen from deposit wallets associated with infrastructure that the company had stopped using after a previous security incident. The disclosure followed several days of conflicting public statements about suspicious blockchain transactions. The exchange had initially described reports of a new breach as a false alarm before acknowledging that funds had been lost. According to reporting published by The Block on October 25, 2026, the incident involved approximately 15.99 million USDT taken from older wallet addresses. CoinDCX said the loss would be absorbed by the company and maintained that customer funds held in its segregated cold wallets remained safe. The incident has nevertheless raised questions about wallet management, automated security processes and the challenges cryptocurrency exchanges face when maintaining legacy infrastructure. How the theft occurred CoinDCX said the affected wallets were associated with infrastructure dating back to a security incident in July 2025. According to the exchange's explanation, an automated process designed to move deposited funds between wallets stopped working for a period. As a result, deposits accumulated in addresses that the company considered retired or deprecated. The subsequent theft involved approximately 15.99 million USDT, a dollar-linked stablecoin operating on the Tron blockchain. CoinDCX stated that it would cover the financial loss rather than pass it on to customers. However, the incident exposed a potential weakness in the assumption that older wallet addresses cease to represent a security risk once an exchange stops intentionally using them. Blockchain addresses may remain accessible indefinitely. If customers or external systems continue sending assets to an old address, those funds can still be exposed if the associated private keys have been compromised. The incident therefore illustrates why cryptocurrency businesses need to manage legacy addresses as carefully as their active infrastructure. Why the automated transfer system matters Cryptocurrency exchanges often operate systems that move customer deposits from individual deposit addresses into wallets used for liquidity management or secure storage. Automated sweeping processes can reduce the time assets remain in operational wallets and help exchanges consolidate funds. However, these systems depend on reliable monitoring, correct configuration and appropriate security controls. If a process stops working, funds may remain in addresses for longer than intended. A failure becomes particularly serious when an address has previously been exposed to an attacker. The CoinDCX incident raises questions about how the exchange monitored the affected infrastructure and whether it had sufficient safeguards to prevent deposits from accumulating in vulnerable wallets. The publicly reported information does not establish every technical detail of the attack or precisely how the attacker obtained access to the funds. Those questions would require a more complete technical investigation. The controversy over the initial response The incident attracted additional attention because the exchange's initial public response differed from its subsequent admission of losses. According to The Block, suspicious transactions were identified before CoinDCX publicly acknowledged the approximately $16 million loss. The company's co-founder and chief executive, Sumit Gupta, had initially characterised reports of a new breach as a false alarm. The exchange later explained that the affected addresses were old wallets associated with the earlier incident. That distinction did not eliminate the central issue: cryptocurrency had been taken from addresses associated with its operations. The sequence highlights the importance of communicating carefully during security incidents. Prematurely dismissing reports can damage confidence if subsequent investigation establishes that a genuine loss occurred. For exchanges, transparent communication is essential because customers rely on companies to safeguard assets and provide timely information when something goes wrong. Are customer funds safe? CoinDCX said customer funds held in segregated cold wallets remained safe and that the company would absorb the loss. Cold storage generally involves keeping private keys in systems isolated from ordinary online access, reducing exposure to certain remote attacks. However, the effectiveness of any custody arrangement depends on how it is implemented and whether the wider operational infrastructure is properly managed. The exchange's statement that it would absorb the loss is important, but users should distinguish between the company's public assurances and independently verified information about the incident. The reported theft does not automatically establish that all customer funds were compromised. Equally, the existence of secure cold wallets does not mean that every operational wallet is protected against the same threats. Lessons for cryptocurrency exchanges The incident highlights several security priorities for digital asset platforms. First, companies must maintain an accurate inventory of active, retired and compromised addresses. Second, automated transfer systems require monitoring and alerting so that unexpected interruptions can be identified quickly. Third, exchanges need procedures for handling deposits sent to addresses that are no longer considered safe. Finally, security teams must ensure that old infrastructure cannot remain a source of exposure simply because it is no longer part of the intended operating model. These measures are especially important for platforms handling large volumes of customer deposits. What happens next? The incident places CoinDCX's security practices and public communications under scrutiny. Users will be interested in whether the company can demonstrate that the vulnerability has been contained and that similar failures cannot recur. Independent forensic analysis and clearer information about the affected systems could help establish what went wrong. For the broader cryptocurrency industry, the case demonstrates that security risks can persist long after a major incident appears to have been resolved. The central lesson is that retiring a wallet is not enough: exchanges must ensure that compromised infrastructure cannot continue accumulating funds or expose customers to additional losses.