CoinDCX admits loss from failed deposit sweeping on old wallet addresses

Exchange takes responsibility for uncollected deposits

Indian crypto exchange CoinDCX admitted on October 22 that it suffered operational losses because a system designed to collect user deposits from old wallet addresses failed. The exchange stated that it has absorbed these losses and credited affected customers’ deposit wallets. This update came hours after CoinDCX initially denied that its current systems were breached.

The issue stems from a security incident in July 2025. Although CoinDCX retired specific wallet addresses following that event, some users continued to send digital assets to those deprecated addresses. The company’s automatic “sweeping” process, which should have moved these funds to secure accounts, did not work as intended until the failure was detected on the morning of October 22.

Discrepancy between exchange statement and investigator claims

On-chain investigator ZachXBT alleged that $15.8 million in user deposits were unaccounted for. He claimed that a specific address remained active for 10 months after the July incident and that funds were swept to CoinDCX’s hot wallet. CoinDCX did not quantify the exact loss amount in its public update, nor did it specify the duration of the failed process. While on-chain data confirms a transfer of 15,819,002 USDT from the disputed address on October 21, CoinDCX maintains that this data does not prove who controlled the wallets or that customers lost funds.

Key numbers and timeline

• October 22, 12:47 p.m. BST: CoinDCX released an update acknowledging operational losses and stating that affected customers were credited.
• $15.8 million: The amount ZachXBT alleged was unaccounted for in user deposits.
• 15,819,002 USDT: The confirmed on-chain transfer from the disputed address to a TRON address on October 21.
• July 2025: The date of the previous security incident linked to the retirement of the affected addresses.

What CoinDCX says

CoinDCX CEO Sumit Gupta initially stated at 9:10 a.m. BST on October 22 that the exchange’s wallets had not been breached and that current central or user addresses had not sent money to the flagged old addresses. However, in a later update at 12:47 p.m. BST, the exchange confirmed that the failure in the sweeping process led to losses that it absorbed. CoinDCX reiterated that customer assets are held in segregated cold wallets and that trading continues normally. The company noted that it had warned users to stop using the old addresses but that some continued to deposit to them.

What is still unclear

There is a disagreement regarding the scale of the issue. ZachXBT points to a specific $15.8 million discrepancy, while CoinDCX has not publicly confirmed this figure as the total loss. It remains unclear how long the sweeping process was failing before it was discovered on October 22. Additionally, the on-chain evidence of a large USDT transfer confirms movement of tokens but does not definitively prove that customer funds were stolen or lost, as the chain data does not reveal wallet control or intent.

Sources

• CryptoSlate