CoinDCX reports 15.99 million USDT loss after deposit-sweeping service outage

Key Facts

CoinDCX said an outage in its automated deposit-sweeping service resulted in a loss of 15.99 million USDT, which the company said it absorbed, in an update published on October 25 about activity it detected on October 21. The company said the service was down for a period, allowing deposits to accumulate at an old, retired address. It said customers’ crypto deposit balances were unaffected and that it credited the affected deposits to users’ accounts. Trading and active wallets continued without interruption, it said. Its services operated during the 72 hours before the update without disruption or withdrawal restrictions, it added.

According to CoinDCX, the issue was with the service that sweeps deposits from retired addresses, not with active wallets. A period of downtime in automated scanning left funds at an abandoned address with unknown vulnerabilities, the company said. CoinDCX described the amount as an operational loss it had absorbed, while confirming that customers’ balances were fully credited. The company said: "This resulted in a loss of 15.99 million USDT, which the company absorbed." It also said it would strengthen monitoring of its remaining systems and the controls around them. It renewed its call for users to update their deposit addresses.

The address in question, known as TQKJQ, was linked to legacy operational infrastructure that CoinDCX said it shut down after a security incident on July 19, 2025. In its report at the time, the company said proceeds from the earlier incident amounted to about 44 million USDT. It said 155,830 SOL remained unspent in the originating wallet when the report was published. It also said the flow of funds included the consolidation of 4,443 ETH in a wallet on the Ethereum network. CoinDCX reported the incident to India’s competent cyber incident response authorities on July 19, 2025. These details place the current address within operational infrastructure that had previously been shut down, according to the company’s account.

Management had previously denied that the reported activity was linked to the company before later acknowledging the operational loss. CoinDesk reported that CoinDCX initially said the old addresses were created in January 2025 and compromised in July of the same year. The report said CEO Sumit Gupta said the 2025 attackers might be reusing old addresses, describing the warning as a "false alarm." The subsequent update attributed the loss to the scanning service outage and put it at 15.99 million USDT. CoinDesk also reported that the funds were sent to a single address on the Tron network. The largest single transaction was 15,819,002 USDT, according to the report.