CoinDCX Loss Confirmed After CEO Called It a False Alarm

The CoinDCX loss is now official, and the way it played out is a lesson in how not to handle a crisis. India's biggest crypto exchange admitted over the weekend that about sixteen million dollars in Tether vanished from old deposit wallets, just days after its CEO told the internet the whole thing was a false alarm.

According to The Block, CoinDCX said in a blog update early Sunday that exactly 15.99 million USDT was taken from deposit wallets the company had stopped using. The exchange says it is absorbing the whole hit, so customers are not out of pocket. Still, the story of how the admission arrived is the part everyone online is chewing on.

How the timeline unraveled

It started on Wednesday morning, when a researcher who goes by Darcy flagged huge outflows from wallets linked to CoinDCX. The funds, roughly sixteen million dollars of USDT plus a pile of Tron tokens, moved into a single Tron address on Tuesday. From there the money was split up and sent on to deposit addresses at Binance, OKX and Gate, per the same account.

CEO Sumit Gupta replied in under three hours. He wrote that the claim was incorrect, that CoinDCX wallets were not breached, and that hackers seemed to be reusing old addresses compromised in a July 2025 attack. The company's official account backed him up minutes later and called the claims misleading.

Then the receipts started coming in. As reported by CoinDesk, on-chain investigator ZachXBT said at least one of those supposedly abandoned addresses had stayed in use for ten months after the 2025 incident. It had swept user deposits into CoinDCX's current hot wallet as recently as April and May of this year. In other words, the old wallet was still catching real customer money.

What actually broke

Here is the plain-English version. Every exchange user gets a personal deposit address. The exchange then runs an automated sweeping service that moves those deposits into its own main wallets, so nothing sits around in places that are easy to attack.

CoinDCX says that sweeping service failed for a period of time. Because of that, deposits piled up at old addresses that carried unknown vulnerabilities, and an attacker drained them. The company also says it warned users after the 2025 hack not to send funds to those retired addresses, but some people kept doing it anyway.

That explanation is plausible, but it does not match the first story. Calling something a false alarm is a very different move from admitting a broken safety process cost the firm sixteen million dollars. Gupta had also said no user funds would be at loss, and the exchange now says it credited every affected user from its own reserves.

Why this one stings for CoinDCX

This is not the first rough stretch for the company. The July 2025 hack cost it about forty-four million dollars. Bengaluru police later said hackers posing as recruiters tricked a software engineer into installing malware that opened the door to internal systems.

In March, Indian police arrested Gupta and his co-founder Neeraj Khandelwal over a fraud complaint, which CoinDCX said came from scammers impersonating it through a copycat site. Coinbase invested in the exchange in October 2025 at a reported valuation of two point four five billion dollars, so the stakes for trust are high.

ZachXBT did not hold back. He advised users to pull their funds off the platform and said the founders had either lied or been negligently incompetent. A spokesperson for the exchange's public relations agency pointed reporters to the blog post and did not answer follow-up questions, according to The Block.

What Gen Z crypto users should take from it

The exchange insists that all customer assets sit in segregated cold wallets and that trading, deposits and withdrawals kept running normally. If that holds up, this is a story about sloppy housekeeping rather than a stolen vault. The money that was lost came from a leftover plumbing problem, not the main treasury.

Even so, the lesson is simple. Always double check the deposit address your exchange shows you today, and never reuse an old one saved in a notes app or a wallet book. Retired addresses can look harmless and still be the weakest link in the whole system.

It is also a reminder that transparency matters more than speed in a crisis. A quick denial that later collapses does more damage than a slower, honest update. For more on the money side of the internet, browse the crypto section, where this kind of exchange drama keeps showing up.

For now, the CoinDCX loss stays at sixteen million dollars, the company says users are whole, and the open question is whether people will trust a platform that spent days insisting nothing had happened.