CoinDCX Absorbs $15.99M Loss From Wallets It Had Already Retired

Deprecated Infrastructure, Active Losses

On October 25, CoinDCX confirmed what blockchain data had already started to show four days earlier: the Indian crypto exchange had taken a direct $15.99 million USDT hit after an automated wallet-sweeping service stopped functioning, leaving deposited funds sitting idle inside wallet infrastructure the company had already retired from active use. The failure went undetected long enough for nearly $16 million to accumulate in addresses no one was actively monitoring.

The exchange moved quickly to frame the damage as self-contained, stating that customer deposit balances and all active trading infrastructure remained untouched throughout the incident. CoinDCX absorbed the loss internally, meaning no customer funds were directly at risk – but the gap between what the exchange initially told the public and what it later confirmed raised its own set of questions.

CoinDCX initially dismissed early observations of the wallet activity as a false alarm.

What the On-Chain Data Showed

Blockchain analytics firm Bitquery tracked the movement on October 21, four days before CoinDCX’s public statement. According to Bitquery’s data, approximately 15.99 million USDT was drained across 40 TRON-based wallets linked to CoinDCX. Of that total, roughly 15.82 million USDT – the vast majority – originated from a single deposit address. That concentration in one wallet is not incidental; it maps directly onto how sweeping failures behave in practice.

Sweeping services exist specifically to prevent this kind of accumulation. When a user deposits funds into an exchange, those deposits typically land in individual addresses assigned to that user. The sweeping process then moves those funds into consolidated wallet infrastructure on a rolling basis. If that automation breaks down, deposits stop moving – and they pile up wherever they landed. In this case, they piled up inside deprecated wallets that CoinDCX had retired following a separate security incident in 2025.

The 2025 security incident is what originally caused those wallets to be taken out of service. CoinDCX deprecated the infrastructure afterward as a precautionary measure. What the exchange apparently did not do was ensure that deposits had stopped routing into those addresses, or that the sweeping process was still functioning correctly for what remained inside them. The result was a live accumulation problem inside dead infrastructure – a combination that, once exploited, left little room for recovery.

The Gap Between Dismissal and Confirmation

When on-chain observers first flagged the wallet movements on or around October 21, CoinDCX’s initial response was to categorize the activity as a false alarm. That characterization did not hold. By October 25, the exchange had reversed course and confirmed the full scope of the loss, attributing it specifically to the failed automated sweep and the deprecated wallet infrastructure.

CoinDCX’s October 25 statement did not include details about why the sweeping service failed, how long it had been malfunctioning before the drain occurred, or what internal monitoring was in place to detect exactly this kind of operational breakdown. The explanation offered was functional – it described what happened in structural terms – without addressing the chain of decisions or detection failures that allowed $15.99 million to sit unprotected in retired wallets long enough to be drained.

The exchange was clear that the financial impact was absorbed by CoinDCX rather than passed to customers. That distinction matters operationally, but it does not explain how deprecated infrastructure remained accessible to incoming deposits after being retired from service. Deprecated typically implies isolation from live transaction flows – the fact that deposits continued routing into these wallets suggests the deprecation process was incomplete, or that the connection between active deposit addresses and retired consolidation wallets was never fully severed.

Operational Risk in Crypto Infrastructure

What this incident illustrates is a category of exchange risk that sits outside the more commonly discussed threats – not a direct hack of live systems, not a smart contract exploit, not a phishing attack on customer accounts. Instead, it’s the kind of failure that emerges when backend automation degrades quietly, without triggering visible alerts, inside infrastructure that the organization believes it has already moved past. The 2025 security incident that preceded this deprecation remains a separate event; this loss is a downstream consequence of how the aftermath was managed.

CoinDCX operates in India’s increasingly regulated crypto environment, and a $15.99 million self-absorbed operational loss of this nature will likely attract scrutiny from both users and regulators evaluating how the exchange handles its own infrastructure lifecycle. The company’s active customer systems are reportedly unaffected and trading continues, but the accuracy of its initial public response – calling the wallet activity a false alarm before reversing that position – is the detail that lingers.

Whether the sweeping service failure was a software bug, a configuration error, or something introduced during the infrastructure deprecation process following the 2025 incident is still not publicly answered.