CoinDCX reported a loss of approximately $16 million on October 21, 2026, after attackers drained funds from deposit wallets the exchange had retired following its 2025 security breach. The India-based exchange attributed the loss to a failure in its automated sweeping service, which moves funds between internal wallets, causing user deposits to accumulate in addresses no longer actively monitored. CoinDCX absorbed the financial impact and credited affected users from internal reserves, while Tether froze $2.21 million in related USDT on October 22.
Automated Sweeping Service Failure Caused Fund Accumulation
The outflow totaled approximately 15.99 million USDT and 5,784 TRX, moving from 40 TRON addresses into a newly created address. CoinDCX stated its automated sweeping service "had failed for a particular period," during which user deposits continued arriving at addresses the exchange was no longer using. The exchange described the damage as an operational loss rather than a hit to customer balances and stated trading operations were not disrupted.
CoinDCX Credited Users and Tether Froze $2.21 Million
CoinDCX credited affected users from internal reserves. On October 22, Tether froze approximately $2.21 million in USDT tied to the incident. The $2.21 million freeze represents a fraction of the total $16 million loss, with CoinDCX absorbing the bulk of the damage.
July 2025 Hack Preceded Wallet Retirement
In July 2025, CoinDCX lost an estimated $44 million from an internal liquidity account in a hack. The addresses at the center of the October 2026 incident were the ones the exchange stopped using after that breach. CoinDCX maintained that customer assets held in segregated cold storage were not affected by the 2025 breach.
On-Chain Analysts Identified Continued Wallet Activity
On-chain analysts ZachXBT and Bitquery flagged that at least one of the TRON addresses labeled as retired had stayed active after the designation. That address reportedly kept interacting with CoinDCX's hot wallet for months after the July 2025 hack.
FAQ
What caused the $16 million loss at CoinDCX on October 21, 2026?
CoinDCX attributed the loss to a failure in its automated sweeping service, which moves funds between internal wallets. The failure caused user deposits to accumulate in addresses the exchange had retired after its July 2025 hack, allowing attackers to drain approximately 15.99 million USDT and 5,784 TRX from 40 TRON addresses.
How did CoinDCX respond to affected users after the October 2026 incident?
CoinDCX credited affected users from internal reserves and absorbed the financial loss itself. The exchange stated trading operations were not disrupted. Tether froze approximately $2.21 million in USDT tied to the incident on October 22, though this represented only a fraction of the total loss.
