Indian crypto exchange CoinDCX said on October 25, 2026, that an attack on legacy wallet infrastructure led to the loss of 15.99 million USDT after suspicious transactions on October 21. The exchange said it covered the loss with its own funds, leaving customer assets and balances unaffected.

The affected addresses had been compromised in a July 2025 hack, CoinDCX said in its report. Its active trading systems and wallets were not attacked, and deposits and withdrawals continued without restrictions.

Funds accumulated in legacy infrastructure

Onchain researcher Darcy reported suspicious transfers on October 21 from addresses linked to CoinDCX. According to Darcy, attackers withdrew about 15.99 million USDT and 5,783.81 TRX from a hot wallet and several deposit addresses on the TRON network.

The largest single transfer was about 15.82 million USDT. The funds were later distributed among several addresses, including some linked to deposit infrastructure at Binance, OKX and Gate.

CoinDCX said it detected anomalous activity on October 21 and identified suspicious onchain fund movements the following day. Its investigation found that the incident involved legacy infrastructure decommissioned after the 2025 hack, although some users continued sending cryptocurrency to the old addresses.

Under CoinDCX’s process for handling those transfers, funds were first credited to a customer’s balance. An automated system was then supposed to move the assets to the exchange’s active, secured wallets.

The mechanism eventually stopped working properly, allowing deposits to accumulate at a legacy address that remained vulnerable after the previous attack, CoinDCX said. The exchange attributed the loss of 15.99 million USDT to that failure but did not specify how the attackers accessed the funds or whether they were connected to the 2025 attack.

Management response draws criticism

After the initial reports, CoinDCX CEO and co-founder Sumit Gupta denied that a new hack had occurred. He said the addresses identified by researchers had been created in January 2025 and compromised in July, suggested that the attackers had reused old wallets and described reports of a new incident as a false alarm.

Onchain analyst ZachXBT challenged that account. He said a liquidity provider continued using one of the deposit addresses for 10 months after the July 2025 hack. According to ZachXBT, user deposits sent through the address were still being forwarded to an active CoinDCX hot wallet in April and May 2026, conflicting with the exchange’s claim that it had completely stopped using the old infrastructure.

ZachXBT also said CoinDCX staff failed to detect promptly that about $15.8 million in user deposits was missing. Gupta responded that the investigation was continuing and said customers would not bear the losses.

The analyst later urged users who valued their assets to withdraw all funds from CoinDCX. He accused the exchange’s co-founders of publicly and privately denying the theft, saying management had either knowingly misled users or displayed serious incompetence.

ZachXBT also said that, despite his disagreements with the company, he helped freeze part of the stolen cryptoassets worth a six-figure dollar sum.

CoinDCX said it delayed its detailed acknowledgment until October 25 to complete an internal investigation and reconstruct the sequence of events. The company also acknowledged that it needed stronger monitoring of legacy infrastructure and additional warnings about the risks of sending funds to outdated addresses.

Previous attack

CoinDCX previously lost about $44.2 million in July 2025 after an operational wallet was compromised. Law enforcement later determined that attackers posed as recruiters and persuaded a developer to install malware on a work computer, giving them access to the exchange’s internal systems.

The two incidents brought CoinDCX’s total losses to about $60.2 million.

Source: Incrypted