CoinDCX's $16 million loss: what happened and what to do
CoinDCX lost about $16 million in USDT from retired wallets in October 2026, days after its CEO called the reports a false alarm. What users need to know.
- Checked against the rules: Oct 2026
- Sources cited · No buy or sell calls
India's largest crypto exchange by trading volume has had its second security incident in about 15 months. Here's what happened and what it means if you use CoinDCX.
What happened
On 21–22 October 2026, on-chain researchers flagged about 15.99 million USDT moving out of TRON addresses linked to CoinDCX. CEO Sumit Gupta replied on X that the reports were "incorrect", that the addresses dated from the July 2025 hack, and that it "sounds like a false alarm".
On 25 October, CoinDCX confirmed a loss of 15.99 million USDT. It said customers had kept sending deposits to deprecated wallets, and an automated "sweeping" service meant to move those funds into its main wallets had failed for a period. That let deposits build up in addresses that had been compromised. Investigator ZachXBT disputed the claim that the wallets were fully retired, pointing to activity in April and May 2026.
Tether froze about $2.21 million of the stolen funds. CoinDCX said it would absorb the loss and acknowledged it could have disclosed the incident sooner.
Are customer funds safe?
CoinDCX says customer balances are held in segregated cold wallets and that trading, deposits and withdrawals continued as normal. The July 2025 incident, about $44 million taken from an internal operational account, was also covered from the company's treasury.
What CoinDCX users should do
- Use a fresh deposit address every time. Copy it from the app right before you deposit. Never reuse an address saved from months ago, or one from your wallet's history.
- Check the network (TRON, Ethereum, BNB Chain and so on) matches what the app shows.
- Turn on withdrawal whitelists and two-factor authentication.
- Keep long-term holdings off the exchange, in a wallet you control.
- Spread your risk across more than one platform. See how to choose an exchange.
Why it matters
Exchanges absorbing losses is good for users, but trust also depends on fast, honest disclosure. This incident, together with WazirX's 2024 hack and the Binance hack in October 2026, shows why Indian users should look at an exchange's security record and communication, not just its fees.
Sources
- CoinDesk: CoinDCX absorbs $16 million loss tied to retired wallet
- The Block: CoinDCX confirms $16 million loss days after CEO called reports a false alarm
- Cryptopolitan: CoinDCX admits $16M USDT loss
Frequently asked questions
Did CoinDCX users lose money?
CoinDCX says no: customer balances were unaffected and the company covered the loss.
Is CoinDCX FIU-registered?
Yes. Registration covers anti-money-laundering duties; it's not a safety guarantee. See what FIU registration means.
Was this guide helpful?