CoinDCX denied a breach, then confirmed a $16 million loss. What exchange statements can and can't tell you

On October 22, the CEO of Indian crypto exchange CoinDCX told the public its wallets were not breached and said the alarm "sounds like a false alarm." Three days later, CoinDCX's own blog confirmed a loss of 15.99 million USDT. US readers generally can't use CoinDCX, but the way this unfolded is a useful lesson for anyone who keeps crypto on an exchange anywhere.

What happened, in order

• October 21: According to CoinDCX's October 25 update, it noticed unusual activity in its systems that day. That day, roughly $16 million in USDT, a dollar-pegged stablecoin, moved out of wallets linked to the exchange on the TRON network. On-chain researchers flagged the transfers publicly early on October 22.
• October 22, morning: Co-founder and CEO Sumit Gupta posted on X that the flagged addresses had belonged to CoinDCX before its July 2025 hack and were compromised then. He wrote that "CoinDCX wallets are not breached," that it "sounds like a false alarm," and asked people not to spread rumours.
• October 22, minutes later: CoinDCX's official account said users' funds were safe, called the claims "misleading" and said the activity did "not have any connection with CoinDCX."
• October 22, later: CoinDCX's official account posted that some users had kept depositing to those retired addresses, that its process for sweeping (moving) such deposits into its main wallets "failed" for a period, and that this caused "operational losses" the company absorbed. It gave no amount.
• October 23: Blockchain analytics firm AMLBot reported that Tether had frozen about $2.2 million linked to the outflow.
• October 25: CoinDCX's blog put a number on it: the failed sweeping "led to a loss of 15.99 million USDT which was absorbed by the company." It said it "could have been more proactive."

What CoinDCX says

CoinDCX says the affected wallet was part of old operational infrastructure, compromised in July 2025 and retired, that still had unknown weaknesses. It says users who mistakenly deposited to those old addresses were credited straight away, while a separate service was meant to move the funds to safety, and that service had stopped working. It says its active wallets, trading, deposits and withdrawals kept running normally, and that user funds "remain safe in secure, segregated cold wallets."

What ZachXBT disputes

Independent blockchain investigator ZachXBT challenged that account on X. He alleged that the deposit address at the center of the incident was used by a liquidity provider for 10 months after the July 2025 hack and was still sweeping deposits into the exchange's current public hot wallet as late as April and May 2026. In his words, that means "$15.8M in user deposits was unaccounted for." In a later post he told people to withdraw their funds and said the co-founders had denied a theft publicly and privately before disclosing it. These are his allegations. CoinDCX's October 25 update doesn't respond to them by name or say how long its sweeping service was down, and neither side's account has been independently audited.

How Tether froze part of it

USDT on TRON has a blacklist function that lets Tether stop specific addresses from moving the tokens. AMLBot reported that funds in two parked addresses moved one hop before the freeze, and that about $2.2 million is now frozen. AMLBot's earlier tracing, reported by The Crypto Times, found about $5.5 million had gone to OKX, $2.8 million to Binance and $1.4 million to Gate before the freeze. Tether hadn't issued its own public statement on these freezes when The Crypto Times reported them. A freeze only helps while stolen stablecoins sit in addresses that can be identified.

The lesson: first statements aren't proof

Exchanges often respond within hours, before anyone has the full picture. Gupta's first post was firm and specific, and it turned out to be incomplete. CoinDCX later acknowledged it took time to review the old infrastructure. Some practical takeaways:

• Wait for the full write-up. An early "funds are safe" is a starting point. Look for a detailed follow-up with amounts, a timeline and what changed.
• Weigh independent evidence. Blockchain transactions are public, and investigators can sometimes see what a company hasn't said yet.
• Remember what custody means. Coins on an exchange are custodial: you rely on the company's security, its record-keeping and its honesty. Proof-of-reserves pages show what a company chooses to publish, not everything that can go wrong.
• Always copy a fresh deposit address from the app or website. CoinDCX's warning that deposits to retired addresses are "highly risky" applies everywhere.
• Expect recovery scams. After a public incident, fake "fund recovery" services target worried users. See our recovery scams guide.

What it means for US readers

CoinDCX is an Indian company, and its help center says a valid PAN card (India's tax ID) is mandatory to open an account, so most Americans can't use it. The broader pattern isn't unique to India: in September, as we covered in our look at the Liquid and Bitget hacks, large losses hit platforms whose users did nothing wrong. Many people keep only what they actively trade on an exchange and hold longer-term savings in a wallet they control; our wallets guide explains the trade-offs. This is education, not financial advice, and it reflects CoinDCX's statements and public reporting as of October 26, 2026.

Published October 26, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.

About the author

Dave McNaught

Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.

Full bio