India's largest crypto exchange absorbs $16 million loss from internal process failure tied to retired wallet

CoinDCX lost $15.99 million because customer deposits reached an old wallet that had already been retired after a 2025 security breach. The exchange had credited customers’ accounts, but the money was not successfully moved into its primary wallet. The company absorbed the loss rather than passing it to users.

Some customers continued sending funds to the deprecated addresses. A service called sweeping was supposed to transfer those deposits automatically. That process failed for a particular period, so funds accumulated in the compromised wallet. Blockchain investigator ZachXBT linked unusual movements to an address called TQKJQ.

CoinDCX said its customers’ balances, active wallets, and trading systems were unaffected. It also said user funds remained in segregated cold wallets, while acknowledging that it should have disclosed the incident sooner. The post did not identify who moved the funds or call the event a new hack.

A deprecated crypto wallet is an address that an exchange has retired from its operating system. CoinDCX deprecated the addresses after they were compromised during the July 2025 security incident. However, retirement did not automatically prevent customers from sending funds there. The addresses still existed and could receive blockchain transactions.

Some users mistakenly continued depositing into those old addresses. CoinDCX said it credited their portfolios when the funds arrived. A separate sweeping service was meant to move the money from each deprecated address into the exchange’s primary wallet. That process failed during a particular period, allowing deposits to remain in the old infrastructure.

This mattered because the old wallet had been compromised. The exchange said the resulting loss was $15.99 million, which it absorbed. The incident shows why retiring an address requires more than simply stopping its normal operational use. Exchanges also need reliable controls for deposits that still arrive at old addresses.

CoinDCX said it absorbed a loss of $15.99 million in USDT. That amount is substantial, but it was smaller than the approximately $44 million cost of the exchange’s July 2025 security breach. Using those figures, the newer loss was about 36% of the earlier breach’s reported value.

The two figures describe different parts of the story. The $44 million figure refers to the security incident that compromised the old wallet infrastructure in July 2025. The $15.99 million figure refers to deposits that later accumulated in deprecated addresses after a transfer process failed.

CoinDCX said customers’ balances, active wallets, and trading systems were unaffected, and the company absorbed the newer loss. The article does not say whether the old addresses were hacked again or identify who moved the funds. It does show that operational failures can create major financial exposure even after wallets are retired.

A sweeping service automatically gathers deposits received at individual or temporary addresses and transfers them into an exchange’s primary wallet. It matters because customers may continue using old deposit addresses, even after an exchange has replaced them. The sweep is a backup process that helps reconcile those incoming funds with the exchange’s active infrastructure.

CoinDCX said users sent deposits to addresses it had retired after the 2025 breach. The exchange credited those users’ portfolios as soon as the funds arrived. But sweeping failed for a particular period. As a result, the deposits accumulated in the deprecated wallet instead of moving to the primary CoinDCX wallet.

The accumulated funds were later linked to irregular outflows totaling 15.99 million USDT. CoinDCX said it absorbed the loss. It did not call the event a hack or explain who controlled the irregular movements. The failure highlights how a secondary operational service can affect real customer funds.

CoinDCX described the loss as a problem in retired wallet infrastructure, not a failure of its active customer systems. It said customers’ balances, active wallets, and trading systems were unaffected. The company also stated that user funds remained in secure, segregated cold wallets protected by layered custody and offline controls.

The distinction comes from how the deposits were handled. Some users sent funds to old addresses, and CoinDCX credited their portfolios when those deposits arrived. A failed sweeping service then left the deposits in the deprecated wallet. CoinDCX said the resulting 15.99 million USDT loss was absorbed by the company.

That means the exchange presented the incident as a corporate loss rather than a deduction from customer account balances. Still, the event exposed a weakness in retired infrastructure and deposit handling. CoinDCX acknowledged that it could have been more proactive in disclosing the situation while it reviewed the sequence of events.

A hot wallet is connected to online systems and supports active transfers, deposits, or withdrawals. A cold wallet is kept offline by design. CoinDCX said customer funds remained in secure, segregated cold wallets, protected by multi-layer custody and offline security controls. The article describes the affected address as part of old operational wallet infrastructure.

The practical difference is exposure. Hot wallets are easier to use for routine transactions, but their online connection creates more opportunity for unauthorized movement. Cold wallets are less convenient, but offline storage makes direct remote access harder. Exchanges therefore generally keep most customer funds offline while retaining limited operational liquidity online.

CoinDCX said the retired-wallet incident did not affect balances, active wallets, or trading systems. It attributed the loss to deposits stranded in deprecated infrastructure and said the company absorbed it. The case still shows why exchanges need strong controls around old addresses, automated transfers, and deposits that arrive after retirement.

USDT is a cryptocurrency commonly known as Tether’s dollar-linked stablecoin. The article identifies CoinDCX’s loss as 15.99 million USDT. Unlike a bank transfer hidden inside a private ledger, a blockchain transaction is recorded publicly, allowing observers to inspect transfers between wallet addresses.

Blockchain investigators can label addresses associated with an exchange, then follow incoming and outgoing transactions. They can compare the amounts, dates, and destination wallets to normal patterns. In this case, ZachXBT flagged suspicious outflows and identified an address called TQKJQ. The investigator said it had swept user deposits to CoinDCX’s current public hot wallet in April and May 2026.

Public tracing can reveal movement, but it does not automatically reveal the person behind an address. CoinDCX confirmed the wallet belonged to old operational infrastructure, but its post did not identify who made the irregular movements. It also did not say whether the old addresses were hacked again.