CoinDCX Absorbs $16M USDT Loss From Retired Wallets in 2026

India's largest crypto exchange by trading volume has confirmed that it lost 15.99 million USDT, the dollar-pegged stablecoin issued by Tether, from wallet infrastructure it says it retired after a hack in July 2025. In a blog post published on October 25, 2026, CoinDCX said an automated "sweeping" service that was supposed to move stray deposits out of those old addresses "had failed for a particular period," letting funds pile up where they should not have been. The company says it absorbed the full loss and that customer balances, active wallets and trading were never affected.

The story matters well beyond one exchange. It started with on-chain sleuths, moved through an initial denial, and ended with a disclosure that the company itself admits "could have been more proactive." Along the way it exposed a weak spot that most retail users never think about: what happens to an exchange deposit address after the exchange stops using it, and what happens to the money people keep sending there.

This analysis walks through what happened, where the two accounts of the incident disagree, what Tether's partial freeze did and did not achieve, and what every exchange user should change about how they deposit crypto.

What happened between October 21 and October 25

According to CoinDCX's own timeline, the exchange "noticed unusual activity in our systems" on October 21, 2026. It says its controls kept active wallets and trading systems safe. The next day, blockchain data and reports from users showed "irregular fund movement," and a deeper investigation found that the activity "had impacted our old, deprecated wallet infrastructure which had unknown vulnerabilities."

The public on-chain record fills in the detail. Independent analysis by BlockintAI and CryptoWatchDesk, both reading public TRON blockchain records, describes the same sequence:

Starting at 12:33 UTC on October 21, dozens of small TRON addresses linked to CoinDCX sent USDT to a single new address beginning TAg6SZ1Hhg.
At 15:35:54 UTC, one deposit address beginning TQKJQ sent 15,819,002 USDT in a single transfer, roughly 99% of the total.
BlockintAI counts 15,991,414.31 USDT arriving at the receiving address in 46 transfers from 41 addresses, plus about 5,789 TRX.
By 03:22 UTC on October 22, the receiving address had passed everything on, mostly to three fresh wallets that took about 7.14 million, 4 million and 3 million USDT.

The first public alarm came from an X account called Darcy, who flagged the outflow as a suspected theft. As CoinDesk reported on October 23, CoinDCX's first response was a flat denial. A spokesperson said the addresses were "old wallet addresses created in January 2025," compromised in July 2025, and "have not been used by CoinDCX since," adding that the activity "does not have any connection with CoinDCX." Co-founder and CEO Sumit Gupta called it a false alarm on X.

Within hours, the company's account shifted. It acknowledged that some users had kept depositing to deprecated addresses, that its sweeping process had failed, and that "operational losses" had been absorbed. It did not give a number until Sunday, October 25, when the blog post put the loss at 15.99 million USDT. CoinDesk's October 26 follow-up notes that the post does not call the event a hack and does not say who moved the funds or how.

Retired, or still running? The two accounts

The central dispute is whether the TQKJQ address was truly abandoned.

CoinDCX's position is that the whole operational wallet setup exposed in the July 2025 breach was deprecated that year. It says users were given clear guidance to use updated addresses, but some kept sending funds to the old ones anyway. Rather than leave those customers stranded, the exchange ran two separate processes:

Credit the user's portfolio as soon as funds land in the deprecated wallet.
Run a secondary sweeping service that moves those funds into the primary CoinDCX wallet.

Because crediting and sweeping were decoupled, customers saw their balances immediately. The flip side is that if the sweep stopped working, money could accumulate in an address the company considered compromised, and that is what CoinDCX says happened.

On-chain investigators read the same records differently. ZachXBT, one of the best-known independent blockchain investigators, replied publicly that TQKJQ "was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet." An LP is a liquidity provider, and a hot wallet is an internet-connected wallet an exchange uses to pay out withdrawals.

BlockintAI's reading of TronGrid data supports the claim that the address was busy. It found TQKJQ received 756 USDT transfers totalling 101,259,817.27 USDT from March 27, 2025 onward and forwarded 610 of them, worth 85,440,815.27 USDT, to a single address beginning TU7Bb, the last on May 4, 2026. Its balance just before October 21 was exactly 15,819,002 USDT, the size of the big transfer. CryptoWatchDesk found that the 15.8 million had built up between January and March 2026, almost all from one sending address.

Both research outlets are careful about the limits here. The chain shows which addresses signed which transfers. It does not show who held the keys, and CoinDCX has not said publicly whether TU7Bb is its wallet. So the evidence supports a narrower conclusion than "CoinDCX lied": the retired addresses were still moving large amounts of money well into 2026, and the process meant to empty them stopped running long enough for roughly $16 million to sit exposed.

That is also consistent with CoinDCX's own description. If users keep depositing and the exchange keeps crediting them, the address is retired in name only. It still holds real value, and it is protected by keys the company already knew were compromised.

Why this is not the same as the July 2025 hack

It helps to separate the two incidents.

In July 2025, as TechCrunch reported at the time, attackers drained about $44.2 million from an internal operational account that CoinDCX said was "used only for liquidity provisioning on a partner exchange." Gupta said the exposure was limited to that account and would be covered "from our own treasury reserves." The stolen funds were routed through Solana-Ethereum bridges and consolidated into 4,443 ETH and 155,830 SOL. CoinDCX also launched a recovery bounty of up to 25% of any recovered funds.

The October 2026 loss is smaller, but in some ways more uncomfortable. Nobody has described a new exploit of CoinDCX's live systems, and the exchange insists there was none. Instead, the loss appears to come from known-compromised infrastructure that kept handling money for more than a year after the first breach. CoinDCX now says that old setup had "unknown vulnerabilities," that the sweep failed, and that it will "strengthen our monitoring and controls around residual systems."

For an exchange that TechCrunch described in 2025 as having over 16 million users and being registered with India's Financial Intelligence Unit, the lesson is that decommissioning is a security process, not a bookkeeping one. An address does not stop being a target because a company marks it deprecated in an internal system.

What Tether's freeze caught, and what it missed

USDT on TRON has a feature that Bitcoin and most native coins do not: the issuer can blacklist an address on the token contract, which stops it from sending USDT. That makes a stablecoin theft different from a crypto theft. There is, in theory, a kill switch.

In practice, timing decides everything. BlockintAI found that at 22:45:39 UTC on October 22, the USDT contract recorded nine blacklisting events in a single block. Reading balances directly from the contract the next morning, it found those nine addresses held 2,212,850.29 USDT between them, about 14% of what left. CryptoWatchDesk independently put the frozen balance at about 2.21 million USDT. Neither outlet found a public statement from Tether, and the chain does not show who requested the freeze.

The other 86% had already moved. Two researchers who traced the funds, Darcy and the analytics firm AMLBot, agree that large amounts reached deposit addresses at OKX, Binance and Gate, though their totals differ. BlockintAI reports AMLBot's figure as roughly $9.7 million and Darcy's as about $8.9 million, and says it has not independently verified either count. Once funds land at a centralized exchange, only that exchange can say whether the accounts were stopped.

Three takeaways from the freeze:

Issuer freezes are real but slow. The receiving address had emptied itself by 03:22 UTC on October 22, and the freeze came almost 20 hours later. What got caught was mostly money still parked in brand-new wallets one or two hops downstream.
Speed of detection is the bottleneck. BlockintAI notes the earliest public post it found came about 14 hours after the large transfer. A loss that the owner does not flag quickly is a loss that issuers cannot easily claw back.
Freezes are public. Anyone can check an address's blacklist status on the token contract or a block explorer. A freeze is often the first hard sign that investigators and the issuer are acting.

If you want the bigger picture on how stablecoin issuers are being regulated, including freeze powers, our breakdown of the OCC's final GENIUS Act stablecoin rule covers the new US framework.

What this means for CoinDCX users and every exchange customer

CoinDCX says customer deposit balances are "unaffected and fully accounted for," that user funds remain in "secure, segregated cold wallets," and that the platform ran with no downtime and no withdrawal limits through the episode. We have no independent data contradicting that, and the company absorbed the loss rather than passing it to users. That is the right outcome for customers this time.

But the exchange's own guidance contains a warning worth reading twice: "Depositing to deprecated addresses is highly risky, and exchanges do not typically take liability for them." In other words, CoinDCX chose to make users whole, but not every exchange will, and the incident was triggered in part by people sending money to addresses they had saved long ago.

Here is what we would change in your own routine, whatever exchange you use:

Copy a fresh deposit address every time. Open the exchange's app or website and copy the address it shows you right now. Do not reuse an address saved in another wallet's address book or an old note.
Delete retired addresses. If an exchange tells you an address is deprecated, remove it from every wallet where you have it saved so nobody in your household or team can reuse it by accident.
Check the network as well as the address. USDT exists on several blockchains. Sending on the wrong network to the right-looking address is another common way to lose funds.
Verify the full string. CryptoWatchDesk warns that attackers create look-alike addresses with the same first and last characters. Check the middle too.
Keep your transaction hash. If a deposit never shows up, open a support ticket with the transaction ID. The chain proves you sent it; the exchange's books decide whether you are credited.
Ignore "recovery" offers. Anyone who messages you offering to recover funds from this incident should be treated as a scammer.
Do not leave long-term holdings on any exchange. A strong exchange is great for buying and selling. For savings you plan to hold, a self-custody wallet removes this whole class of operational risk. Our guide to the best Bitcoin wallets for beginners explains the trade-offs, and our Ledger vs Trezor comparison covers hardware options.

If you are choosing where to trade in the first place, look at how a platform talks about incidents, not just its fees. The best crypto exchanges for beginners guide is a good starting point for comparing custody practices and track records.

The bigger lesson: disclosure and decommissioning

Two things stand out about how this unfolded.

The first is disclosure. CoinDCX's first public answer, within roughly a day of the outflow, was that the activity had no connection to the exchange. Its own later post concedes that a sweep it ran had failed and that the loss was its own. To its credit, the company said plainly that "it took us some time to do the thorough review of the deprecated infrastructure and confirm the sequence of events. We could have been more proactive." Still, the sequence is a reminder that independent on-chain researchers are now often the first line of detection, and that an exchange's initial statement is a starting point rather than the final word.

The second is decommissioning. Exchanges rotate addresses after breaches for good reason, but rotation only works if the old addresses are actually emptied, watched and eventually shut off. CoinDCX says it will now remind users that maintaining deprecated addresses "is a time-bound activity." That implies a cut-off date after which deposits to old addresses will no longer be swept or credited. Users of any exchange that has rotated addresses should assume the same may happen to them.

For the wider market, the incident fits a pattern we have covered this year, from protocol exploits in our DeFi hack crisis analysis to the Qubic weak-seed wallet drain. The flashy exploits get the headlines, but a large share of losses comes from mundane operational gaps: keys that were never rotated, processes that quietly stopped, and addresses nobody was watching.

Key facts at a glance

Loss: 15.99 million USDT on TRON, absorbed by CoinDCX, per its October 25, 2026 blog post.
Cause, per CoinDCX: deposits kept arriving at wallet infrastructure compromised in the July 19, 2025 incident, and the automated sweeping service failed for an unspecified period.
Disputed point: ZachXBT and on-chain data show the main address forwarding funds to a current hot wallet until May 4, 2026.
Frozen: 2,212,850.29 USDT across nine addresses, blacklisted at 22:45:39 UTC on October 22, about 14% of the total, per BlockintAI.
Customer impact, per CoinDCX: none to balances, active wallets or trading.
Prior incident: about $44.2 million stolen from an internal liquidity account in July 2025, covered from treasury.

The open questions are who controlled the keys that moved the money on October 21, how long the sweep was down, and whether exchanges holding the downstream deposits stopped any of it. Until CoinDCX or the receiving exchanges say more, the safest assumption for users is simple: the only deposit address you should trust is the one your exchange shows you today.