CoinDCX, India's largest crypto exchange, has absorbed a $16 million loss stemming from an internal process failure involving a retired wallet from its operational infrastructure.
The Mumbai-based exchange initially dismissed reports of suspicious outflows as a false alarm. However, the exchange later acknowledged that users had continued sending funds to deprecated addresses that were compromised during a July 2025 security breach that cost CoinDCX approximately $44 million.
According to CoinDCX's account, some users mistakenly deposited funds into the retired addresses even after the exchange deprecated them following the 2025 incident. The exchange said it credited those users' portfolios immediately upon receipt of the funds. A secondary automated process called sweeping was meant to transfer deposits from the deprecated wallet to CoinDCX's primary operational wallet. That sweeping process failed for a particular period, causing deposits to accumulate in the deprecated address.
CoinDCX reported noticing unusual activity in its systems on October 21, and detected irregular fund movement via blockchain data and user reports the following day. The exchange said the loss totaled $15.99 million in USDT, which the company absorbed directly.
The exchange stated that customers' crypto deposit balances remain unaffected and fully accounted for, and that all user funds are held in secure, segregated cold wallets protected by multi-layer custody and offline security controls. CoinDCX also said its active wallets and trading systems experienced no impact from the incident.
CoinDCX acknowledged in a blog post that it took time to conduct a thorough review of the deprecated infrastructure and could have disclosed the situation more proactively. The exchange said it shared the update once it had confirmed the complete sequence of events.
