In an updated statement on October 22, CoinDCX said some customers continued depositing cryptocurrency into old wallet addresses despite warnings that those addresses were no longer safe. The exchange maintained a process for collecting and securing those deposits, but acknowledged that the process had stopped functioning for an unspecified period.
The company said the failure resulted in operational losses that it would absorb. It did not disclose the amount lost or establish whether the entire $16 million identified by investigators represented its financial exposure.
CoinDCX maintained that affected customer deposits had already been credited, current wallets were not compromised and customer assets remained segregated in cold storage.
What Went Wrong With CoinDCX’s Compromised Wallets?
The controversy began when blockchain investigator Darcy, co-founder of asset recovery platform FlashRescue, identified approximately $16 million in transfers from addresses labeled as belonging to CoinDCX.
The flagged activity included a transaction involving approximately 15.8 million USDT on the Tron network. The transfers prompted concerns that CoinDCX might have suffered another security breach.
CoinDCX initially rejected that interpretation, explaining that the addresses had been created in January 2025 and compromised during the July 2025 attack. The exchange said those wallets had subsequently been retired from active use.
Blockchain investigator ZachXBT challenged that explanation, identifying a deposit address beginning TQKJQ that allegedly continued operating for approximately 10 months after the original breach.
According to the investigator, the address continued forwarding deposits to CoinDCX’s publicly identified hot wallet and receiving cryptocurrency to cover transaction fees as recently as April and May 2026.
CoinDCX’s subsequent admission clarified that deposits had continued arriving at compromised addresses and that its fund-consolidation process had failed. However, the exchange has not published a complete reconciliation explaining the disputed transfers or the precise duration of the failure.
Investor Takeaway
The approximately $16 million identified onchain should not automatically be classified as a confirmed loss. CoinDCX has acknowledged financial exposure but has not quantified it. The distinction matters when assessing the company’s balance-sheet impact and the reliability of its operational controls.
Why Did the Original $44 Million Hack Matter?
The latest incident follows CoinDCX’s July 19, 2025 security breach, when attackers stole approximately $44 million from an operational account used for liquidity management.
As FinanceFeeds reported at the time, CoinDCX said the affected account was separate from customer custody infrastructure and that the company would cover the losses using its treasury reserves.
The investigation subsequently led to the arrest of a software engineer following allegations that attackers had obtained access through compromised credentials and malware. FinanceFeeds previously detailed the arrest and the suspected credential-compromise mechanism.
CoinDCX also introduced a recovery bounty offering up to 25% of recovered assets to individuals or organizations helping trace the stolen funds.
The new disclosure introduces a different operational problem. Even after the original breach was contained, deposits continued arriving at addresses that had previously been compromised.
That created an ongoing exposure requiring the exchange to identify incoming transactions, secure accessible funds and maintain accurate customer balances.
The failure of that process raises questions about how effectively compromised wallet infrastructure was isolated after the 2025 incident.
Investor Takeaway
Covering customer balances protects users from an immediate recognized loss, but does not eliminate the exchange’s financial exposure. Repeated operational losses could affect treasury resources even when customer custody wallets remain uncompromised.
Are CoinDCX Customer Funds at Risk?
CoinDCX said all deposits received through the compromised addresses had been credited to the relevant customer accounts. It also maintained that funds held in its current operational wallets had not been stolen.
The company reported that trading and other platform operations were continuing normally.
Nevertheless, customer balances being credited does not independently establish that the exchange successfully recovered the underlying cryptocurrency from compromised addresses.
That distinction is important for evaluating whether CoinDCX has absorbed the entire exposure or whether additional liabilities could emerge from its transaction reconciliation.
India’s cryptocurrency sector has previously faced similar questions about exchange solvency and customer protection. Following the $230 million-plus WazirX breach in 2024, the exchange encountered substantial restrictions on withdrawals and eventually pursued restructuring, as detailed in FinanceFeeds’ coverage of its withdrawal limitations.
Unlike that incident, CoinDCX has not announced a customer asset shortfall or suspension of normal trading operations in connection with the October transfers.
What Must CoinDCX Disclose Next?
The most consequential unanswered question is the financial size of the newly acknowledged operational losses.
CoinDCX has not specified how long its fund-consolidation process was inactive, how much cryptocurrency accumulated in compromised addresses during that period or how much it successfully recovered.
A wallet-by-wallet reconciliation could establish whether the approximately $16 million flagged by investigators consists entirely of customer deposits, previously compromised assets or transfers with different economic ownership.
The exchange’s next disclosures will also determine whether the failure was limited to legacy deposit processing or exposed weaknesses in its wider wallet-monitoring procedures.
Investor Takeaway
The immediate focus is no longer simply whether CoinDCX experienced another hack. Investors and counterparties need a quantified loss figure, reconciled transaction records and evidence that the failed deposit-recovery process has been corrected.