CoinDCX has confirmed a loss of 15.99 million USDT after suspicious transactions on Oct. 21, 2026, drained funds from legacy wallet infrastructure the exchange says had already been compromised during its 2025 hack.
According to the company, the incident did not affect customer balances, active trading systems, or current wallets. CoinDCX said it absorbed the loss with its own funds, while deposits and withdrawals continued to operate normally.
How the funds were exposed
CoinDCX said the breach involved old TRON deposit infrastructure that had been decommissioned after the July 2025 attack. Even after that transition, some users reportedly continued sending funds to outdated deposit addresses.
The exchange said those deposits were still being credited to customer accounts through a sweeping mechanism designed to move incoming funds from the old addresses into secured wallets. At some point, that process failed, allowing funds to accumulate at a legacy address that remained vulnerable.
CoinDCX did not explain how access was obtained in the latest incident or whether the drain was directly tied to the earlier compromise. It described the event as stemming from infrastructure already affected in the 2025 hack.
What moved on-chain
The company said suspicious transfers were detected on Oct. 21 and that the total loss came to 15.99 million USDT. The largest single transaction was about 15.82 million USDT.
CoinDCX added that the funds were then spread across multiple addresses associated with different deposit systems. Its public explanation focused on the failure of the automatic sweeping setup rather than a compromise of current production wallets.
Dispute over the company’s handling
The incident drew criticism from on-chain investigator ZachXBT, who said CoinDCX management had previously misrepresented the situation. He also urged users to withdraw assets from the platform.
CoinDCX later released a fuller report acknowledging the loss and reiterating that the exchange’s active trading infrastructure was not breached. The company maintained that customer assets were unaffected and that normal platform operations continued.
Broader context after the 2025 hack
This is the second major security-related loss disclosed by CoinDCX in connection with the aftermath of its 2025 breach. In July 2025, the exchange lost about $44.2 million after an operational wallet was compromised.
Combined with the newly confirmed 15.99 million USDT loss, the total damage across the two incidents is about $60.2 million. CoinDCX said the latest event underscored the need for stronger monitoring of legacy infrastructure and clearer warnings to users against sending funds to obsolete deposit addresses.
The next confirmed step from the company is continued operation of deposits and withdrawals under its current systems, alongside tighter controls around old wallet infrastructure that should no longer receive customer transfers.
Source: incrypted.com