According to CoinDesk, CoinDCX, the Indian exchange it ranks first by trading volumes, says it took on a $16 million loss after a service meant to move deposits out of a retired wallet failed. The admission follows days of denials and leaves open how the funds actually left.
CoinDCX confirms the loss after first rejecting the reports
CoinDesk reported that CoinDCX has confirmed a $16 million loss tied to a wallet it retired after an earlier security incident. The Mumbai-based exchange, which CoinDesk describes as India's largest by trading volumes, says it has absorbed the loss itself.
The confirmation reverses the company's earlier stance. According to CoinDesk, on-chain sleuths the previous week pointed to roughly $16 million in questionable outflows tied to addresses associated with the exchange. CEO Sumit Gupta answered on X by calling the reports a false alarm, and The Block noted that he made the remark on Wednesday, saying early breach reports sounded like "a false alarm."
On Sunday, CoinDCX published a blog post tying the activity to a wallet labeled TQKJQ. The company said the address belonged to its old operational wallet infrastructure.
How a retired wallet kept collecting customer deposits
CoinDesk's account of the blog post says the wallet was compromised in the security incident that CoinDCX disclosed on July 19, 2025, which led the exchange to deprecate it. Some users nevertheless kept sending deposits to the retired addresses. According to CoinDesk, CoinDCX credited those customers' portfolios the moment funds reached the deprecated wallet.
The exchange describes a secondary service, which it calls sweeping, that was meant to move the funds into its primary wallet. Sweeping is a routine exchange practice. Deposits land in many addresses, and an automated job consolidates them into a central wallet so balances can be managed in one place.
CoinDCX says that job failed for a particular period. Deposits therefore accumulated in the deprecated address instead of moving on. The company ties the loss, which CoinDesk quotes in USDT, to that failure.
The key figures in the CoinDCX disclosure
The numbers in CoinDesk's report show how the story moved from a rumored breach to an admitted operational failure.
- About $16 million: the amount of suspicious outflows flagged by blockchain sleuths, and the loss CoinDCX now says it absorbed.
- About $44 million: the cost CoinDesk attributes to the July 2025 hack.
- January 2025: when, according to a CoinDCX spokesperson, the addresses cited by the sleuths were created.
- April and May 2026: the months in which ZachXBT said at least one cited address was still sweeping user deposits to the exchange's current public hot wallet.
Where the CoinDesk and The Block accounts agree and differ
Both outlets agree on the core sequence. Each reports that Gupta dismissed breach reports before CoinDCX confirmed a loss of about $16 million connected to retired wallets. The Block's coverage consists of a headline and a short summary, so it supports only that framing and the timing of the CEO's remark.
CoinDesk adds the detail. It reports that a CoinDCX spokesperson first said the addresses were old, unused since the 2025 hack and unconnected to the exchange. ZachXBT, a well-known on-chain investigator, disputed that. He said that at least one of the addresses was being used by a liquidity provider, and that it moved user deposits into the current hot wallet as late as April and May 2026.
That conflict matters. The exchange's later blog post describes the wallet as part of its old infrastructure, which is consistent with the investigator's claim that it was not entirely dormant. CoinDesk's report does not say whether CoinDCX has addressed the liquidity-provider detail directly.
What the blog post does not say
CoinDesk notes that CoinDCX's post avoids describing the incident as a hack. The post also leaves out who carried out the irregular fund movement and the way it took place. CoinDesk has asked CoinDCX whether the wording means the retired addresses were hacked again, and its report carries no answer.
CoinDCX also said that customer funds are held in secure, segregated cold wallets with multi-layer custody and offline controls. Cold wallets are kept offline by design, which separates them from the deprecated infrastructure at the center of this episode.
On the delay, the exchange said the review of its deprecated systems took time. It acknowledged it could have been more proactive, but said it published the update once it had the complete picture.
Why the episode matters and what to watch
For customers, the main lesson is practical. Retired deposit addresses can keep receiving funds if users have saved them, and the exchange then depends on back-end sweeping to keep those funds under control. Users can check that they send deposits only to the address currently shown in their account. Exchanges, for their part, can audit whether any deprecated address still holds balances or receives transfers.
For the exchange, the case tests how it handles disclosure after a prior hack. CoinDCX moved from calling the reports a false alarm to confirming a loss within days, and it chose to cover the shortfall from its own resources.
Several questions remain open. It is not yet clear whether the funds were stolen, who moved them, or whether the failed sweeping process gave a third party an opening. It is also unclear how long the failure lasted and whether CoinDCX will publish more technical detail.
FAQ
How much did CoinDCX lose?
According to CoinDesk, CoinDCX says it lost $16 million, in line with the roughly $16 million in suspicious outflows that blockchain sleuths had flagged. The exchange says it absorbed the loss itself.
Was the CoinDCX loss a hack?
CoinDCX's blog post avoids describing the loss as a hack. According to CoinDesk, the post names no party behind the fund movement and gives no account of the method, and CoinDesk has asked whether the retired addresses were compromised again.
Are user funds at CoinDCX safe?
CoinDCX states that user funds remain in secure, segregated cold wallets with multi-layer custody and offline security controls. That is the company's own statement, and CoinDesk reports it as such.
Sources
Written by the Coinvote news desk from reporting by CoinDesk and The Block. Not financial advice.
