CoinDCX Reports 15.99 Million USDT Loss After Deposit Transfer Service Failure
Key Facts
CoinDCX said in an update published on 25 October that a failure in its automated deposit transfer service led to a loss of 15.99 million USDT, which the company said it absorbed. The announcement followed the platform’s detection of unusual activity in its systems on 21 October, then irregular fund movements in blockchain data the following day. It said deposits had accumulated in an old address after the service that moved them to the main wallet stopped working for an unspecified period. The company said users’ deposit balances were unaffected and were "fully safeguarded and accounted for." It also said trading, deposits and withdrawals continued without interruption, and that its active infrastructure and operational wallets remained functional.
According to CoinDCX’s investigation, the address was part of an old operational wallet infrastructure that the company had abandoned after a security incident it reported on 19 July 2025. It said some users continued depositing to the old addresses despite being directed to use updated addresses. The platform credited deposits to users’ accounts and then transferred them automatically to its main wallet, but a failure in the automated scanning service for an unspecified period halted that process. As a result, the funds remained in the abandoned address instead of moving to the main wallet. CoinDCX said the investigation also uncovered previously unknown vulnerabilities in the affected legacy infrastructure.
Bitquery’s analysis showed that about 15.82 million dollars of the funds came from a single address containing 88 deposits that had not previously been transferred, according to the analysis. Bitquery detected a gap of 5 minutes between the platform’s last routine transfer and the attacker’s first transfer on 21 October. In a subsequent development, Bitquery said Tether froze 2.21 million dollars in USDT across 9 wallets late on 22 October. The freeze covers part of the funds and does not mean they have been returned to CoinDCX. The company did not mention recovering the funds in its update announcing that it had absorbed the loss.
In the July 2025 incident, CoinDCX said a single internal operational account, used to provide liquidity to a partner platform, was compromised following a sophisticated server breach. Its report said the proceeds amounted to about 44 million USDT and were routed through several transfers. The company said at the time that it had covered its financial exposure from its reserves and reported the incident to CERT-In on 19 July. It added that it was working with cybersecurity experts and partners to trace the funds and attempt to recover them. CoinDCX linked the address affected in the current incident to the legacy wallet infrastructure it said it had stopped using after the 2025 breach.
Operationally, CoinDCX said its platform had run during the 72 hours before the 25 October update without interruption, withdrawal restrictions or trading disruptions. It described deposit balances as unaffected and said customer funds were held in separate cold wallets. The company acknowledged that its communication could have been faster, saying: "We could have been more proactive, but we published this update as soon as we had the full picture." The update marks the company’s shift from monitoring unusual activity to acknowledging a loss caused by an internal service failure, with details of the fault provided after its investigation was complete. Statements about the safety of balances and continuity of service remain the company’s own.
CoinDCX said it would strengthen monitoring of its remaining systems and the controls around them, and would repeatedly remind users to update their deposit addresses. It added: "We will strengthen our monitoring and controls around the remaining systems." It also said it would continue directing users to updated addresses to prevent deposits to discontinued addresses. According to the company’s statement, the next steps will focus on monitoring the remaining legacy infrastructure and improving reminders to change addresses. The update did not specify a timeline for these measures.