India's largest crypto exchange absorbs $16 million loss from internal process failure tied to retired wallet
Indian crypto exchange CoinDCX absorbed a $16 million loss after a failure in its 'sweeping' process caused user deposits to accumulate in a deprecated wallet. The wallet had been previously compromised in a 2025 security incident, leading to confusion regarding the safety of the funds.
Why it matters
This incident underscores the operational risks and technical complexities involved in managing legacy infrastructure within cryptocurrency exchanges.
It all started last week, when blockchain sleuths flagged about $16 million in suspicious outflows from wallets linked to the Mumbai-based exchange. CoinDCX was quick to dismiss the reports, with CEO Sumit Gupta calling it a false alarm on X.
A spokesperson told CoinDesk that the addresses cited by the sleuths were old ones, created in January 2025 and compromised in the July 2025 hack, which cost the exchange about $44 million, and that CoinDCX had not used them since. In essence, the exchange said the activity did not have any connection with CoinDCX. But ZachXBT, a well-known on-chain investigator, said at least one of those addresses, labeled TQKJQ, was in use by a liquidity provider and swept user deposits to CoinDCX’s current public hot wallet as recently as April and May 2026.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in