CoinDCX says it has absorbed a new loss of 15.99 million USDT, Tether’s dollar-linked coin. The Indian exchange’s October 25 update blames a failed service that should have moved deposits out of old wallets. [1] [2]
The surprising part is that customers had already been credited. A balance could appear in an account while the coins still sat in the old address. For traders trusting an exchange with their money, that gap matters. [1]
View the reported amounts and dates
| Incident | Reported amount |
|---|---|
| July 19, 2025 | Approximately 44; operational-account exposure |
| October 2026; quantified October 25 | 15.99; loss tied to old wallets |
Both bars start at zero on a shared 0–50 million USDT scale. The amounts concern separate incidents; they do not establish a common attacker, remaining losses or customer balances. [3] [1]
Money credited before money moved
The exchange describes two steps: record the customer’s deposit, then transfer the coins to the intended wallet. That transfer is called sweeping. When the second step stopped working, coins built up in an address the company had retired. [1]
“This led to a loss of 15.99 million USDT which was absorbed by the company.”
The exchange’s wallet-activity update [1]
CoinDCX says customer balances are unaffected and trading, deposits and withdrawals continued without interruption. Those assurances describe its response; they do not independently reconcile every affected deposit. [1]
The immediate distinction is between a loss the business says it will bear and a cut imposed on customers. Normal trading can continue while the company deals with a custody failure behind the account screen.
An old problem returns
The earlier incident happened on July 19, 2025. CoinDCX described a compromised internal account used to supply trading liquidity on another exchange, with approximately 44 million USDT of exposure. It said its own reserves would cover that incident too. [3]
This time, the first public response was dismissive. The Block reports that co-founder and chief executive Sumit Gupta initially called breach reports a false alarm. The exchange later acknowledged operational losses, before putting the 15.99 million USDT figure in Sunday’s update. [4]
The change in the account matters alongside the amount. Customers depend on an exchange to describe which assets were affected and what it has done to protect the rest.
The wallet trail leaves questions
Bitquery’s investigation, first published October 22 and updated October 23, found that the exchange was still moving deposits through affected addresses on October 21. It traced approximately 15.82 million USDT of the stolen amount to one address, where deposits from January through March had remained. [2]
That research can show coin movements. It cannot see the customer balances in CoinDCX’s private books or establish how the attacker obtained the wallet keys. The later company acknowledgment answers who says it is absorbing the loss, without resolving every part of that earlier transaction history. [2]
CoinDCX now has to explain how infrastructure described as retired remained part of its deposit process. Covering the loss addresses the immediate bill. Establishing why those coins stayed exposed is the unfinished part of the story.