CoinDCX said the wallet in question belonged to its former operational wallet infrastructure, which was compromised during the security incident reported by the exchange on July 19, 2025, and was later deprecated.
The post noted that some users mistakenly continued to deposit funds into the deprecated, or retired, addresses even after the exchange had deprecated them following the 2025 hack. CoinDCX credited those users’ portfolios at the moment the funds reached the deprecated wallet.
A secondary service, which the exchange calls sweeping, was intended to move funds from the deprecated address into the primary CoinDCX wallet.
However, that process failed for a period, causing deposits to accumulate in the deprecated address.
“This led to a loss of 15.99 million USDT, which was absorbed by the company,” the exchange said. The blog post did not describe the incident as a hack and did not say who was behind the irregular fund movement or how it happened.
CoinDesk has reached out to CoinDCX to ask whether the old, retired addresses were hacked again.
“We want to reiterate that all user funds remain safe in secure, segregated cold wallets, protected by multi-layer custody and offline security controls,” the exchange said. Cold wallets are kept offline by design.