CoinDCX said on October 22 that a process for sweeping funds out of deprecated deposit addresses, created in early 2025 and retired after its July 2025 security incident, had failed for a period, causing operational losses that it absorbed, and that all affected user deposits had been credited. The Indian crypto exchange had earlier denied claims by blockchain investigators on X that about 15.99 million USDT and 5,783.81 TRX were taken from its hot wallet on October 21, and its statement did not give the size of the loss.
Why it matters: This is the second alleged security incident at CoinDCX in about 15 months, after it lost about $44.2 million in July 2025, and the corrected account came only after on-chain tracing went public. Users had been told to stop using the old addresses, yet deposits kept arriving there, so the sweep was the exchange’s only control on those funds, and it failed without CoinDCX noticing until the morning of October 22.
Source: Moneycontrol, October 22, 2026
Image: Satheesh Sankaran, CC BY 2.0, via Wikimedia Commons
