CoinDCX Absorbs Losses After Failed Sweep of Compromised Deposit Addresses

Indian cryptocurrency exchange CoinDCX said on Oct. 22 that it absorbed operational losses after its automated sweeping mechanism failed to collect customer deposits sent to deprecated wallet addresses ¹. The platform credited impacted customer accounts, following an internal breach in July 2025 where attackers took roughly $44 million from an internal wallet ¹.

According to CoinDCX, users were instructed to stop sending funds to addresses compromised during the 2025 incident ¹. To protect mistaken inflows, the firm ran a routine sweep process to move incoming funds into secure storage ¹. The platform stated on Thursday morning India time that this sweep failed for an unspecified window, creating operational losses that the company opted to cover ¹. CoinDCX has previously faced community scrutiny and denied a fresh hack following $16M outflow from retired addresses ¹.

Disputed On-Chain Movements

The admission follows on-chain scrutiny on Oct. 21, when Tron records showed an address ending in TQKJQ transferred 15,819,002 $USDT to an unknown wallet created hours earlier ¹. CoinDCX co-founder Sumit Gupta initially dismissed reports of a new security incident, calling it a false alarm and claiming the addresses had not been operated by the platform since the 2025 breach ¹.

However, independent on-chain investigator ZachXBT alleged that the address had routed user deposits to CoinDCX's active hot wallet as late as May 2026, alleging that roughly $15.8 million in customer deposits had been left unaccounted for ¹. Gupta subsequently said the company was investigating the activity, pledging that users would not lose funds ¹. CoinDCX maintained that its primary cold reserves were unaffected, while warning that it generally does not assume liability for transactions sent to obsolete deposit destinations ¹.