In a surprising turn of events, Indian cryptocurrency exchange CoinDCX has disclosed a significant loss of approximately $16 million due to compromised wallets. This admission comes just days after CEO Sumit Gupta downplayed the situation, labeling it a "false alarm."
The incident, which occurred on October 25, 2026, involved the transfer of nearly 15.99 million USDT from wallets that CoinDCX had previously deemed inactive. Blockchain analysts raised alarms about suspicious activity linked to these addresses, prompting the exchange to reassess its security protocols.
CoinDCX stated that an automated transfer system malfunctioned, allowing funds to accumulate in wallets that were supposedly retired. Despite the loss, the exchange reassured users that their funds remain secure and that it has absorbed the financial impact.
However, blockchain investigators, including ZachXBT and Bitquery, have challenged CoinDCX's narrative, suggesting that the compromised wallets were still operational long after the exchange had claimed they were inactive. This raises serious questions about the management of older wallet addresses and the security measures in place.
With this latest breach, CoinDCX's total security losses over the past 15 months have now reached nearly $60 million. The situation underscores the ongoing challenges faced by cryptocurrency exchanges in safeguarding user assets and maintaining trust within the community.
