Indian cryptocurrency exchange CoinDCX has confirmed a loss of 15.99 million USDT (roughly ₹152 crore at current rates) from wallet infrastructure it had retired after last year’s cyberattack, and has followed that disclosure with a warning to users about a separate phishing campaign. The company says it has absorbed the loss and that customer funds and active trading systems were not affected.
What CoinDCX has disclosed
In an update on its official blog, the Mumbai-based exchange said it noticed unusual activity in its systems on October 21, 2026, and the next day spotted irregular fund movements through blockchain data and user reports. Its investigation traced the activity to an old operational wallet that was compromised in the July 2025 security incident and had since been deprecated.
According to CoinDCX, some users kept depositing funds to that retired address instead of the updated addresses shown in the app. The exchange credits such deposits to user accounts immediately and runs a separate automated “sweeping” service to move the funds into secure wallets. That sweeping service failed for a period, allowing deposits to build up in the deprecated address, where previously unknown vulnerabilities were exploited. The resulting 15.99 million USDT loss has been borne by the company.
CoinDCX has said that user funds remain in segregated cold wallets with multi-layer custody controls, and that trading, deposits and withdrawals continued without interruption.
From denial to disclosure
The admission came a few days after on-chain investigators flagged suspicious movements from addresses linked to CoinDCX. Co-founder and CEO Sumit Gupta initially described the reports as a false alarm on X, saying the flagged addresses had belonged to the exchange before the 2025 hack and were no longer in use. The exchange later acknowledged that it “could have been more proactive” and said it shared the update once it had the complete picture.
The incident is notably smaller than the July 2025 breach, in which CoinDCX lost about $44.2 million, but it again puts the spotlight on how Indian crypto platforms manage legacy infrastructure after a compromise.
Phishing alert follows
Days after confirming the wallet loss, CoinDCX also flagged a phishing campaign targeting its users, The Hindu BusinessLine reported. The scam used fake notices and emails pushing users to external links, wallet connections and requests for account details. The exchange reiterated that it never asks for private keys, seed phrases, OTPs or withdrawal links.
Why it matters for India’s digital asset ecosystem
For India’s fintech and virtual digital asset sector, the episode underlines three lessons: retired systems need to be fully decommissioned or continuously monitored, incident disclosure needs to be quick and consistent, and security events tend to attract opportunistic phishing that targets anxious customers. CoinDCX has said it will strengthen monitoring around residual systems and regularly remind users to update deposit addresses, treating support for deprecated addresses as a time-bound activity.
As crypto exchanges in India operate under FIU-IND registration and anti-money laundering obligations, and as policymakers continue to weigh a fuller framework for virtual digital assets, how platforms handle security incidents and communicate with users is likely to remain a key test of trust.
