CoinDCX Absorbs Operational Losses After Deposit Sweep Failure on Deprecated Wallet Addresses

Indian cryptocurrency exchange CoinDCX acknowledged absorbing operational losses on October 22 after a process designed to collect deposits sent to legacy wallet addresses failed. The disclosure came hours after the exchange initially denied any new security breach.

In a 12:47 p.m. BST update, CoinDCX stated that some users continued sending funds to addresses deprecated following the platform’s July 2025 security incident. The exchange confirmed it had credited the affected customer deposit wallets and emphasized that active wallets remained unaffected.

The statement followed allegations by blockchain investigator ZachXBT that $15.8 million in user deposits was unaccounted for. CoinDCX did not disclose the specific loss amount in its update or specify how long the sweep process had been failing.

According to the exchange, the addresses had been retired from active use, but some users kept depositing to them despite prior warnings. An automated sweeping process was supposed to regularly collect those deposits so the company could account for and secure them; however, CoinDCX only discovered the failure on the morning of October 22.

From Denial to Acknowledgement

Earlier that day at 9:10 a.m. BST, CEO Sumit Gupta stated that CoinDCX wallets had not been breached. He described the flagged addresses as created in January 2025 and compromised during the July 2025 incident, adding that none of CoinDCX’s current central or user addresses had sent funds to them.

Four minutes later, the exchange’s official account reiterated that it had not used those old addresses since July 2025 and that the reported activity had no connection to CoinDCX. At 9:38 a.m. BST, the account directed readers to Gupta’s denial.

At 9:52 a.m. BST, ZachXBT challenged that account, alleging that the deposit address TQKJQ remained in use for ten months after the July 2025 incident. He further alleged that the address swept user deposits to CoinDCX’s current public hot wallet and received transaction-fee funding.

At 10:59 a.m. BST, Gupta replied that he was aware of the claim, that it was under further investigation, and that no user funds would be lost.

TronGrid event data and TronScan transaction records reviewed by CryptoSlate show a single successful transfer of 15,819,002 USDT from the address beginning TQKJQ to another TRON address at 4:35:54 p.m. BST on October 21. The transfer confirms the tokens moved, but does not establish who controlled either address or whether customers lost funds.

In its later update, CoinDCX maintained that customer assets are held in segregated cold wallets and that trading operations continue normally.

The legacy addresses are connected to the July 2025 incident. Security firm Cyvers linked a roughly $44 million exploit to the Lazarus Group, and CoinDCX said its treasury covered that loss. On July 31, Gupta’s preliminary explanation pointed to social engineering as the attack vector.

The unresolved accounting questions center on how much CoinDCX ultimately absorbed and when the sweep mechanism failed. The exchange’s October 22 update acknowledges those operational losses while leaving both details unspecified.

Source link