CoinDCX Confirms $16M USDT Loss from Deprecated Wallets

Indian crypto exchange CoinDCX has confirmed a loss of 15.99 million USDT — roughly $16 million — after attackers drained deprecated deposit wallets that had been carrying live user funds for months without the exchange's knowledge. The disclosure landed just days after the exchange's own CEO publicly dismissed early breach reports as a "false alarm," a sequence of events that raises serious questions about internal controls, wallet lifecycle management, and the reliability of crypto accounting software used to track fund flows across active and retired infrastructure.

What Actually Happened

CoinDCX published a blog post in the early hours of Sunday 26 October 2026 acknowledging that unusual activity had been detected on Tuesday affecting "old, deprecated wallet infrastructure which had unknown vulnerabilities." The exchange explained that its automated sweeping service, the system responsible for moving incoming user deposits from receiving addresses into secure cold storage, had stopped working for a period of time. Because that sweep process failed, fresh user deposits continued to accumulate at addresses the exchange believed had been decommissioned following its July 2025 hack.

The Sweep Failure and Its Consequences

The mechanics matter here. In normal operations, crypto exchanges run sweeping bots that consolidate funds sitting in deposit addresses into segregated cold wallets at regular intervals. If that process breaks down, customer deposits pile up at the deposit addresses themselves, which carry far weaker security controls than offline cold storage. That is precisely what occurred at CoinDCX: a failure in the sweeping layer left a material balance exposed in addresses the security team thought were idle.

Onchain data flagged by Darcy, an independent blockchain analyst, showed that approximately 15.99 million USDT and 5,783.81 TRX left CoinDCX's hot wallet and a cluster of deposit addresses at 11:35 a.m. ET on Tuesday. The largest single movement was 15,819,002 USDT. All funds initially flowed to one Tron address before being split and routed to deposit addresses at several major exchanges, according to Darcy's analysis.

The CEO's Initial Denial

When Darcy published the alert at 1:30 a.m. ET on Wednesday, CoinDCX co-founder and CEO Sumit Gupta responded within three hours, telling followers on X that the claim was "incorrect" and that the flagged addresses had been compromised back in July 2025, implying the movements were residual hacker activity rather than a new breach. The exchange's official account followed four minutes later, calling the reports "misleading" and stating the addresses had not been in use since the 2025 incident.

That version of events did not survive onchain scrutiny. Blockchain analyst ZachXBT pushed back publicly, pointing out that at least one of the flagged deposit addresses had remained in active use by a liquidity provider for ten months after the July 2025 hack, and that sweeps from that address into CoinDCX's current hot wallet had occurred as recently as April and May 2026. "Meaning $15.8M in user deposits was unaccounted for by your team," ZachXBT wrote.

Gupta acknowledged ZachXBT's challenge and said the team was "investigating it further," adding that "no user funds will be at loss." A few hours later, CoinDCX confirmed that the sweeping process had failed and that operational losses had been absorbed by the company, though it did not name a figure at that stage. The $15.99 million figure appeared in the subsequent full blog post. ZachXBT then publicly advised CoinDCX customers to withdraw their funds, stating that the co-founders had either lied outright or acted with negligent incompetence. He also noted he had helped freeze six figures' worth of stolen crypto on the exchange's behalf.

Context: CoinDCX's Prior Security Incidents

This is the second significant loss CoinDCX has disclosed in roughly fifteen months. The July 2025 hack cost the exchange approximately $44 million. Bengaluru police later confirmed that attackers had posed as recruiters to trick an employee into installing malware on a company laptop, which gave the hackers access to internal systems. Separately, Indian police detained exchange officials in March of this year over a fraud complaint linked to scammers running a copycat site impersonating CoinDCX.

The exchange attracted a notable strategic investment from Coinbase in October 2025, in a round Gupta said valued CoinDCX at $2.45 billion. That transaction deepened Coinbase's push into India and the Middle East and underscored how much institutional confidence the exchange had accumulated before these disclosures began accumulating alongside it.

Accounting and Audit Implications for Firms

For accounting firms, auditors, and CFOs working with crypto-native or crypto-adjacent clients, the CoinDCX incident contains several concrete lessons about how gaps in crypto accounting software and operational controls can leave material liabilities invisible until it is too late.

Wallet Lifecycle Tracking as an Audit Risk

The core problem was not a sophisticated exploit. It was a mismatch between what the exchange's systems believed was happening and what was actually happening on-chain. Deprecated addresses were treated as inactive in internal records while they continued to receive and hold real customer funds. Any audit procedure that relies solely on an exchange's own address registry without independent on-chain reconciliation would have missed this exposure entirely.

Auditors reviewing crypto exchange clients should confirm that the client's address management system reflects the on-chain reality, not just the intended architecture. Addresses formally retired in internal documentation but still receiving funds represent an unrecorded liability and, depending on jurisdiction, a potential custody failure. Under India's current framework, exchanges are expected to maintain robust safeguarding of customer assets, and regulators are likely to scrutinise whether CoinDCX's internal records accurately captured the status of these wallets.

Sweeping Controls as a Financial Reporting Variable

Automated sweeping services are not just an operational convenience. They are a control that determines where assets sit at any given moment, which in turn affects how those assets are classified and reported. If sweeping fails, customer deposits that should appear in segregated cold storage may instead sit in addresses with significantly weaker security, and that distinction should be reflected in risk disclosures and, potentially, in the classification of assets on the balance sheet.

Firms using crypto accounting software to reconcile client positions need to ensure that the software ingests real-time on-chain data rather than trusting a static address whitelist. A sweep failure that lasts for days or weeks will not appear as an anomaly unless the reconciliation tool is actively comparing expected wallet balances against actual on-chain balances at the address level.

Disclosure Timing and Liability

The gap between initial denial and full confirmation took roughly 48 hours. For publicly listed or institutionally backed entities, that timeline raises questions about material disclosure obligations. CoinDCX is not publicly listed, but Coinbase's investment gives it institutional shareholders whose own financial statements may be affected. CFOs at firms with exchange counterparty exposure should revisit credit and custody risk assessments whenever a counterparty exchange discloses a material security incident, particularly one preceded by an inaccurate public denial.

For clients with assets held at CoinDCX, the exchange's statement that the loss has been absorbed by the company and that user funds remain safe in cold storage is reassuring, but it should be verified rather than accepted at face value. Auditors should request written confirmation of the segregation status and request on-chain evidence that client balances are backed by identifiable cold wallet holdings.

AML Considerations: Funds Routed to Major Exchanges

The stolen USDT was routed to deposit addresses at several major centralised exchanges. That routing pattern is a standard money-laundering technique, and it will likely trigger suspicious transaction reporting obligations for those receiving exchanges. Firms providing AML compliance services to Indian crypto businesses should update their transaction monitoring rules to flag outbound Tron-based USDT transfers to unverified addresses, particularly where the sending address has a history of being flagged in onchain incident reports. The use of our onchain investigator findings on the CoinDCX hack provides additional forensic context for compliance teams building these rules.

What the Sequence Tells Regulators and Standard-Setters

India's Financial Intelligence Unit and the Ministry of Finance have been tightening the regulatory environment for virtual digital asset service providers since the 2022 inclusion of crypto businesses under the Prevention of Money Laundering Act. This incident will likely attract regulatory attention for at least two reasons.

First, the initial public denial by senior management followed by a material loss confirmation within 48 hours is exactly the kind of disclosure failure that regulators look for when assessing whether an exchange's governance meets the standard of a fit and proper operator. Second, the technical failure, a sweep bot silently stopping while funds continued to accumulate at vulnerable addresses, suggests that operational resilience standards may not have been met.

Globally, incidents like this reinforce arguments being made in multiple jurisdictions for mandatory real-time proof-of-reserves reporting and independent wallet audits. Firms advising clients on compliance posture should monitor whether India's regulators issue any guidance or enforcement action arising from this incident, as it may signal a higher bar for operational controls at Indian exchanges going forward.

Separately, the stablecoin dimension is worth noting. The entire loss was denominated in USDT on the Tron network, which continues to be the dominant settlement rail for crypto transactions across South and Southeast Asia. Exchanges and their auditors should ensure that Tron-based USDT balances receive the same level of reconciliation discipline as ERC-20 or native-chain assets. For broader context on how stablecoin infrastructure is being regulated elsewhere, the hardware wallet breach and data retention case illustrates how operational gaps across the custody stack continue to create compliance exposure.

Immediate Steps for Accounting and Compliance Teams

For Firms Serving Exchange Clients

Confirm that the client's digital asset accounting software reconciles on-chain balances at the address level, not just at the wallet or entity level. Request evidence that sweep processes are monitored with automated alerts for failure or delay. Ask whether any wallets formally classified as deprecated continue to receive inbound transactions, and if so, what controls govern them. Review custody agreements to determine whether the exchange's absorption of this loss affects the legal structure of client asset segregation.

For CFOs with Exchange Counterparty Exposure

Treat any material loss disclosure at a counterparty exchange as a trigger for a counterparty risk review, regardless of whether the exchange states that client funds are unaffected. Verify that the contractual segregation of your firm's assets is backed by identifiable cold wallet holdings. Consider whether the disclosure timeline, specifically the gap between the incident and accurate public information, affects your assessment of the exchange's governance quality and your willingness to maintain current exposure levels.

Source: The Block

Frequently Asked Questions

What exactly did CoinDCX lose, and are user funds affected?

CoinDCX lost 15.99 million USDT from deprecated deposit wallets that were still accumulating user deposits after the exchange's sweep process failed. The exchange has stated that it has absorbed the loss on behalf of users and that all user funds remain in secure, segregated cold wallets. Clients should request written confirmation and on-chain verification of their specific balances.

What is a sweeping service, and why does its failure matter for accounting?

A sweeping service is an automated process that moves funds from incoming deposit addresses into more secure, centralised cold storage wallets. When it fails, deposits accumulate at less-protected addresses. From an accounting perspective, this creates a discrepancy between the recorded location of assets (cold storage) and their actual on-chain location (exposed deposit addresses), which can distort risk assessments and balance sheet classifications.

Does the CEO's initial denial create any legal or regulatory exposure?

That is a question for legal counsel, but the sequence of a public denial followed by a material loss confirmation within 48 hours is the kind of governance failure that regulators and institutional investors scrutinise closely. In India, virtual digital asset service providers are subject to PMLA obligations that include maintaining accurate records and co-operating with authorities. Any finding that the initial statements were materially misleading could affect regulatory standing.

How should an auditor treat deprecated wallet addresses when auditing a crypto exchange?

Auditors should not rely solely on the exchange's internal address registry. Independent on-chain reconciliation against every address ever associated with the entity should be performed, including those formally classified as retired. Any address receiving inbound transactions should be treated as active for purposes of custody and liability assessment, regardless of its internal classification.

What AML obligations arise for exchanges that received the stolen funds?

Exchanges that received the routed funds as deposits are likely subject to suspicious transaction reporting obligations under their respective jurisdictions' AML frameworks. They will also face pressure to freeze or return the funds as part of any law enforcement or regulatory investigation. Compliance teams at those exchanges should treat any large USDT inflow from a Tron address linked to a known incident as a high-risk transaction requiring enhanced due diligence and prompt STR filing.