CoinDCX’s Wallet Sweep Goes AWOL, Leaving the Exchange $16 Million Lighter

CoinDCX, India’s largest crypto exchange by trading volumes, said it absorbed a $16 million loss after an internal process failed to move customer deposits out of a retired wallet. In a blog post on Sunday, the Mumbai-based exchange quantified the loss as 15.99 million USDT and said customer balances, active wallets and trading systems were unaffected.

Blockchain sleuths flagged about $16 million in suspicious outflows from wallets linked to CoinDCX last week. The exchange initially dismissed the reports, with CEO Sumit Gupta calling them a false alarm on X. A spokesperson told CoinDesk that the cited addresses were old ones, created in January 2025 and compromised in the July 2025 hack, which cost the exchange about $44 million, and that CoinDCX had not used them since; the exchange said the activity had no connection with CoinDCX.

On-chain investigator ZachXBT said at least one of the addresses, labeled TQKJQ, was in use by a liquidity provider and that user deposits were swept to CoinDCX’s current public hot wallet as recently as April and May 2026.

On Sunday, CoinDCX tied the activity to TQKJQ and said the wallet belonged to its old operational infrastructure. “This wallet belongs to our old operational wallet infrastructure, which was compromised during the security incident we reported on July 19, 2025, and was deprecated as a result,” CoinDCX said.

According to the post, users mistakenly continued depositing into the deprecated addresses after CoinDCX retired them following the 2025 hack. The exchange credited users’ portfolios when the funds reached the deprecated wallet, but a secondary service, which the exchange calls sweeping, was meant to move them into the primary CoinDCX wallet. That process failed for a particular period, causing deposits to accumulate. The failure resulted in a loss of 15.99 million USDT, which CoinDCX said it absorbed, and the exchange acknowledged it could have disclosed the incident more quickly.