CoinDCX’s $16 million ‘false alarm’ turns out to be a very expensive sweep fail 😅

CoinDCX, India’s largest crypto exchange by trading volumes, said it absorbed a $16 million loss after an automated “sweeping” service failed to move customer deposits from a retired wallet, with 15.99 million USDT drained on the Tron network on Oct. 21.

Blockchain researchers and the Arkham tracker first flagged roughly $16 million in suspicious outflows, prompting CEO Sumit Gupta to write on X that CoinDCX’s wallets were “not breached” and that the activity looked like “a false alarm.” A spokesperson said the addresses had been created in January 2025, compromised in the July 2025 hack and not used by CoinDCX since. On-chain investigator ZachXBT said at least one, labeled TQKJQ, was still in use by a liquidity provider and had swept user deposits into CoinDCX’s current public hot wallet as recently as April and May 2026.

In a Sunday blog post, CoinDCX said of TQKJQ: “This wallet belongs to our old operational wallet infrastructure, which was compromised during the security incident we reported on July 19, 2025, and was deprecated as a result.” Users continued to deposit into the retired addresses even after they were deprecated, and CoinDCX credited their portfolios when the funds arrived. The secondary sweeping service was intended to transfer the funds into the primary CoinDCX wallet, but it failed for a particular period, allowing deposits to accumulate.

The new loss followed a roughly $44 million hack in July 2025 that CoinDCX blamed on a server breach, which prompted a bounty hunt for the stolen funds and the later arrest of an employee. Together, the two episodes brought the exchange’s losses to nearly $60 million. CoinDCX said customer balances, active wallets and trading systems were unaffected, that it would share further details as its investigation continues and that it could have disclosed the incident more quickly.

CoinDCX also faced fraud and impersonation-scam allegations that drew a police probe this year, while its founder denied reports of acquisition talks with Coinbase after the 2025 hack. Coinbase has separately moved to expand across South Asia and the Middle East.