CoinDCX Hack Explained: What Happened, Are Funds Safe?

# CoinDCX Hack Explained: What Happened, Are Funds Safe?

The CoinDCX hack story has dominated Indian crypto news this week, and the headlines have been confusing: first a denial, then a confirmation. On 25 October 2026, CoinDCX — one of India's largest crypto exchanges — confirmed that 15.99 million USDT had been lost from old wallets. That is roughly $16 million gone, and understandably, Indian users are asking two questions: what actually happened, and is my money safe?

This guide explains the incident in plain language, using what the exchange and independent blockchain researchers have reported so far: the timeline, why old wallets still held money at all, what CoinDCX says about user funds, and the practical safety lessons every Indian beginner should take from this — whichever exchange you use.

> Educational content only. This is not financial advice. Crypto markets are volatile — never invest money you can't afford to lose.

What Happened, in Simple Words

Blockchains are public. Anyone can watch money move between addresses, and specialist researchers spend their time tracking addresses that belong to big exchanges. In the week of 20–21 October 2026, researchers flagged suspicious transfers: about 15.99 million USDT, plus a small amount of TRX, left wallets linked to CoinDCX on the Tron network and landed in a single outside address. From there, the money was split up and parts of it were sent onward to deposit addresses at other large exchanges, a pattern that on-chain analysts say is typical of stolen funds being moved around.

CoinDCX's first response, through CEO Sumit Gupta on X, was that the reports were a false alarm and its wallets were not breached. But as researchers pushed back with more on-chain evidence, the exchange's position changed step by step. It first admitted "operational losses" without a figure, and on 25 October it published a full update confirming the amount: 15.99 million USDT, absorbed by the company.

The key detail is *which* wallets the money left from. According to CoinDCX, these were old, deprecated deposit addresses — created in January 2025 and already compromised in the exchange's July 2025 attack, which cost it about $44 million. In other words, the exchange says this was not a fresh break-in of its current systems. It was money that ended up sitting in addresses the attackers already controlled. How it got there is the next part of the story.

The Timeline: From First Alerts to Confirmation

When	What happened
January 2025	The deposit wallets involved in this incident are created (per CoinDCX)
July 2025	A major attack compromises CoinDCX wallets; the exchange loses about $44 million, and the old addresses are among those compromised
20–21 October 2026	About 15.99 million USDT and a small amount of TRX move out of the old wallets on the Tron network to an outside address
21 October 2026	Blockchain researchers flag the transfers publicly; CoinDCX's CEO initially calls the reports a false alarm
22 October 2026	CoinDCX admits operational losses and says its deposit-sweeping process had failed; the failure is identified that morning
25 October 2026	CoinDCX publishes its full update: 15.99 million USDT lost, absorbed by the company, user funds stated to be safe

Timelines like this are worth reading carefully, because they show a pattern beginners will see again in crypto news: on-chain data surfaces first, official statements evolve over several days, and early denials are sometimes replaced by fuller admissions. Waiting for the detailed statement before panicking — or before celebrating — is usually the wise move.

Why Did Old Wallets Still Hold Money? The Sweeping Failure, Explained

This is the part most headlines skipped, and it is the part that actually explains the loss.

When you deposit crypto to an exchange, you send it to a deposit address assigned to you. Exchanges periodically move those deposits from many individual deposit addresses into their main wallets, where funds are managed and mostly kept in cold storage. This housekeeping step is called sweeping.

CoinDCX says some users continued sending deposits to old, deprecated addresses even after being advised not to — for example, an address saved in another wallet app or copied from an old transaction. Those addresses still belonged to the exchange's system on paper, but they were among the wallets compromised in 2025. The sweeping process that was supposed to move those deposits onward and secure them failed for a period. So deposits accumulated in addresses the attackers could already access — and on 20–21 October, the money was taken.

One independent on-chain investigator, ZachXBT, questioned part of the exchange's account, noting that one of the "retired" addresses appeared to have still been collecting user deposits as recently as April and May 2026 through a liquidity provider. CoinDCX said it was aware and investigating. The full independent picture is still emerging, and the exchange's detailed statement remains the main source for what happened inside its systems.

There is also a small piece of better news in the on-chain trail: analytics firm Bitquery, as reported by crypto news outlets, traced about $9.63 million of the funds to other exchanges, and Tether — the company behind USDT — reportedly froze about $2.21 million. Frozen funds cannot be moved by whoever holds them, though whether any money is ultimately recovered is not yet known.

Are CoinDCX User Funds Safe? What the Exchange Says

This is the question that matters most to Indian users, so here is exactly what CoinDCX has stated — clearly labelled as the company's own position:

• The loss was absorbed by the company; it is not being passed on to users.
• User funds are held in segregated cold wallets, separate from the affected addresses, and its current central and user addresses were not affected.
• Deposits that users sent to the deprecated addresses have been credited to their accounts.
• Trading, deposits and withdrawals continued to operate normally throughout.

Two honest qualifications belong next to those statements. First, they come from the exchange itself; independent verification of the full incident is still limited, which is normal at this stage but worth remembering. Second, this is the second serious wallet incident connected to CoinDCX in two years, after the much larger July 2025 attack. Neither fact means your balance has vanished — but both are exactly the kind of track record a beginner should factor in when deciding how much money to leave sitting on any single platform.

What This Incident Teaches Every Indian Crypto User

You do not need to be a CoinDCX customer for this story to matter. The lessons apply to every exchange, Indian or offshore.

Exchanges are custodians, not vaults you control. When your crypto sits on an exchange, you hold an IOU from that company while it holds the actual assets. Its wallet management — including boring housekeeping like sweeping old addresses — becomes part of your risk. This incident was, at its core, a housekeeping failure.

Old deposit addresses are a real-world trap. If you have ever saved a deposit address in another app, a notes file, or your browser, this is your reminder to delete it. Always open the exchange app fresh and copy the deposit address it shows you at that moment. Networks and addresses change, and sending to a retired address can mean delays, extra recovery steps, or — as this week showed — worse.

Proof of reserves and incident history are part of choosing an exchange. Before keeping meaningful money anywhere, check whether the exchange publishes proof of reserves, whether it is registered with FIU-India, and how it has handled past incidents. An exchange's behaviour in a crisis — speed and honesty of communication — tells you a lot.

Size your exchange balance like it can freeze. Withdrawals continued normally here, but in past industry failures elsewhere, withdrawals have stopped without warning. A common habit among careful users is to keep only what they are actively trading on an exchange and hold longer-term amounts in a wallet they control — while remembering that self-custody has its own risks and responsibilities.

How to Protect Yourself Right Now

News of a hack always triggers a second wave of crime: scams built on the headline. Work through this checklist calmly.

1. Expect phishing. Fraudsters are already likely to be circulating fake "CoinDCX refund", "compensation claim" and "wallet verification" messages on Telegram, WhatsApp and X. CoinDCX will never ask for your password, 2FA code or recovery phrase to credit a deposit — anyone who does is a thief, whatever logo they use.
2. Use only the official app and website. Type the address yourself or use your saved bookmark. Do not follow links from messages, ads or search results during a news spike, when fake sites multiply.
3. Check your deposit history. If you sent crypto to CoinDCX from an external wallet recently, confirm in the app that it was credited. If anything is missing, raise a ticket through official support and keep the transaction hash ready.
4. Turn on every security feature. App-based 2FA, a withdrawal whitelist if your exchange offers one, and a unique strong password. Our step-by-step guide to securing an exchange account walks through each setting.
5. Diversify the boring way. Splitting activity between more than one reputable platform, or moving long-term holdings to self-custody after learning how seed phrases work, reduces the damage any single incident can do to you.
6. Keep your records. Whatever happens — deposits, withdrawals, compensation credits — keep dates, amounts in INR and transaction IDs. You will need them for your own clarity and for taxes. Tax note: crypto tax rules can change — the 30% tax rate and 1% TDS described on this site were current as of September 2026. Verify the latest rules before filing.

The 2025 Attack vs the 2026 Loss: Not the Same Story

	July 2025 incident	October 2026 incident
What happened	Attackers compromised exchange wallets directly	Funds left old wallets already compromised in 2025
Amount	About $44 million	15.99 million USDT (about $16 million)
Root cause (per exchange)	Security breach of wallet infrastructure	Failed deposit-sweeping process on deprecated addresses
Who bore the loss	The company	The company says it has absorbed it
User funds	Stated to be unaffected	Stated to be safe in segregated cold wallets

Keeping these separate matters, because headlines shouting "CoinDCX hacked again" and headlines saying "no hack at all" are both compressing a more specific story: old compromised addresses, a failed internal process, and a loss the company says it has covered.

Keep Learning

• What Happens to Your Crypto If an Exchange Shuts Down?
• How to Secure Your Crypto Exchange Account: A Complete Guide for India
• What Is Proof of Reserves? How Exchanges Prove They Hold Your Crypto

Conclusion: Judge the Process, Not Just the Headline

The CoinDCX incident of October 2026 is best understood as an operations failure on top of an old compromise: deprecated wallets, a sweeping process that silently failed, and deposits that pooled where attackers could reach them. CoinDCX says the loss is absorbed, deposits were credited, and user funds in segregated cold wallets are safe; independent researchers are still testing parts of that account, and the story may gain detail in the coming days.

For a beginner in India, the durable lessons are the ones in your control: copy fresh deposit addresses every single time, guard your account with 2FA and whitelists, treat every hack headline as a phishing season, and decide consciously how much you leave on any one platform. Exchanges will keep having incidents — the users who come through them best are the ones who prepared before the headline arrived.