Indian crypto exchange CoinDCX said it absorbed operational losses after a process for collecting deposits from old wallet addresses failed, according to an Oct. 22 update. The exchange credited affected customers whose funds were sent to deprecated addresses despite earlier warnings.
CoinDCX retired certain wallet addresses from use following a July 2025 security incident, but some users continued depositing funds to those old addresses. The exchange said it had implemented a sweeping process to regularly collect deposits from the deprecated addresses and secure them, but discovered the process had failed on the morning of Oct. 22.
Initial Response and Timeline
CoinDCX CEO Sumit Gupta initially denied a breach at 9:10 a.m. BST, stating that the flagged addresses had been created in January 2025 and compromised in the July incident. He said none of CoinDCX's current central or user addresses had sent money to the old addresses.
Within hours, the exchange reversed course. At 12:47 p.m. BST, CoinDCX acknowledged that some users had continued sending crypto to the deprecated addresses and that the failed sweeping process had caused losses the company absorbed. The exchange did not specify the amount of losses or how long the failed process had lasted.
Unresolved Details
Allegations emerged that $15.8 million in user deposits was unaccounted for, though CoinDCX did not quantify its losses in its update. A confirmed transfer of 15,819,002 USDT from one of the disputed addresses occurred on Oct. 21, but this transaction alone does not establish who controlled the addresses or whether customers lost funds.
CoinDCX maintained that customer assets remain held in segregated cold wallets and that trading continued normally. The exchange's July 2025 security incident resulted in approximately $44 million in losses, which the company said its treasury covered.
