India’s Biggest Crypto Exchange Reports $16M Loss From Retired Wallet Error

CoinDCX, India’s largest cryptocurrency exchange by trading volume, has confirmed a $16 million loss caused by an internal process failure involving a retired wallet. The company says it will absorb the financial hit.

The issue surfaced last week after blockchain investigators reported roughly $16 million in suspicious transactions from wallets associated with the Mumbai-based exchange. CoinDCX initially rejected the claims, with CEO Sumit Gupta describing the reports as a false alarm in a post on X.

A CoinDCX spokesperson told CoinDesk that the flagged addresses were old wallets created in January 2025 and compromised during a July 2025 security breach that cost the exchange approximately $44 million. According to the company, those addresses had not been used since the incident, and the recent activity was unrelated to its operations.

However, blockchain investigator ZachXBT challenged that explanation. He said at least one address, identified as TQKJQ, remained in use by a liquidity provider and had transferred customer deposits to CoinDCX’s current public hot wallet as recently as April and May 2026.

On Sunday, CoinDCX addressed the transactions involving TQKJQ in a blog post, confirming that the wallet was part of its legacy operational infrastructure and that the incident had resulted in a financial loss.

“This wallet belongs to our old operational wallet infrastructure, which was compromised during the security incident we reported on July 19, 2025, and was deprecated as a result,” the exchange said.

CoinDCX explained that some customers continued sending deposits to the retired addresses even after they were decommissioned following the 2025 breach. The exchange said it credited the customers’ accounts as soon as those deposits arrived.

A separate process, known as sweeping, was designed to transfer funds from the deprecated addresses into CoinDCX’s primary wallet. However, the mechanism failed during a specific period, leaving deposits stranded in the old wallet.

As a result, the exchange incurred a loss of 15.99 million USDT, which it said the company would cover itself.

The blog post did not describe the incident as a new hack, identify anyone responsible for the unusual fund movements, or explain how the transactions occurred. CoinDesk contacted CoinDCX to clarify whether the retired addresses had been compromised again.

The exchange emphasized that customer assets remain protected in segregated cold wallets, which are stored offline and secured through multiple layers of custody and security controls.

CoinDCX also acknowledged that it took time to investigate the legacy wallet infrastructure and establish what had happened.

“We could have been more proactive, but we shared this update as soon as we had the complete picture,” the company said.