CoinDCX confirms $16M wallet drain two days after its CEO called the reports a 'false alarm'

Indian crypto exchange CoinDCX said on Sunday, October 25, that attackers took 15.99 million USDT — roughly $16 million — from old deposit wallets it had stopped using after a $44 million hack in July 2025. The company said it is absorbing the loss. The confirmation lands two days after co-founder and CEO Sumit Gupta told users on X that the reports sounded like "a false alarm."

The timeline, reconstructed from on-chain trackers and CoinDCX's own statements by The Block, runs against the exchange's initial account. Darcy, co-founder of asset-rescue firm FlashRescue, flagged the outflow first: at 11:35 a.m. ET on Tuesday, October 21, about 15.99 million USDT and 5,783.81 TRX left a CoinDCX hot wallet and several deposit addresses, all routed to a single Tron address, with the largest single transfer at 15,819,002 USDT before funds were split toward deposit addresses at Binance, OKX and Gate.

Gupta replied within three hours that "CoinDCX wallets are not breached," attributing the addresses to the July 2025 compromise and calling it a likely false alarm. The company's account echoed that four minutes later, calling the claims "misleading." On-chain analyst ZachXBT then countered that one of the addresses had been actively sweeping user deposits to CoinDCX's current hot wallet as recently as April and May 2026 — meaning, in his words, "$15.8M in user deposits was unaccounted for by your team." By mid-morning Gupta said the team was "investigating further" and "no user funds will be at loss"; by 7:47 a.m. ET the company conceded a sweeping-service failure had caused "operational losses," without naming a figure. Sunday's blog post put the number at 15.99 million USDT, blaming "old, deprecated wallet infrastructure which had unknown vulnerabilities" where deposits piled up after an automated sweeping service "failed for a particular period."

Key facts

• Loss confirmed: 15.99 million USDT (~$16M), absorbed by CoinDCX — company blog, Oct 25 (via The Block).
• Outflow timing: 11:35 a.m. ET, Oct 21; single Tron destination, largest transfer 15,819,002 USDT — Darcy/FlashRescue (via The Block).
• Prior incident: ~$44M July 2025 hack; Bengaluru police tied it to malware on an engineer's laptop — The Block.
• Context: Coinbase invested in CoinDCX in October 2025 at a $2.45B valuation per Gupta — The Block.

The real-world read

This is a documented walk-back. Gupta and the company's account both denied a breach on Wednesday; by Sunday the company confirmed a $16 million theft. ZachXBT's read — that the founders "straight up lied or are negligently incompetent" — is his characterization, but the sequence he and Darcy documented on-chain is what forced the number out, not a voluntary disclosure. Note what the company's framing leans on: the repeated line that "all user funds remain safe in secure, segregated cold wallets." That may be true, but it sidesteps the actual failure — a sweeping service that silently broke, leaving live user deposits stranded at an address the firm claimed it had abandoned. Asked about the discrepancy between Gupta's statements and the analysts' findings, CoinDCX's PR agency pointed The Block to the blog post and declined specific follow-ups.

This is reporting, not financial advice.

Sources

• The Block (Tier 2, Oct 25) — reconstructed timeline, loss figure, transaction details, founder statements and police findings; cited primary on-chain work by Darcy/FlashRescue and ZachXBT, and CoinDCX's own blog. No marketing or sponsored content involved.