CoinDCX review: Security After $16 Million Loss From Deprecated Wallets

CoinDCX reported a $16 million loss on October 25, 2026, after attackers drained USDT from TRON deposit addresses that had been retired following the July 2025 breach. The exchange stated it covered the full amount from reserves and confirmed that active customer wallets remained secure and unaffected. Operations continued without interruption.

Incident Timeline and Response

On-chain analysts flagged suspicious outflows of roughly 15.99 million USDT and 5,784 TRX from about 40 legacy addresses around October 21. CoinDCX initially described the activity as a false alarm, but later confirmed that an automated sweeping process had failed to move deposits from deprecated wallets to secure storage.

The addresses had been decommissioned after the 2025 incident that cost the platform approximately $44 million. Some deposits continued to arrive despite warnings, and one address accumulated 88 deposits totaling 15.82 million USDT since early 2026. Tether froze about $2.21 million linked to the flows, and roughly $9.63 million was traced to addresses associated with other exchanges.

CoinDCX holds FIU-IND registration and ISO 27001:2022 certification. It maintains a Crypto Investors Protection Fund that stood at roughly 57 crore rupees in September 2026. Custody partners carry insurance coverage reported at up to $450 million.

User Fund Protection and Platform Operations

The exchange stated that all customer assets sit in segregated cold wallets with multi-layer offline controls. No active wallets, trading functions, deposits, or withdrawals were impacted. Affected deposits to the old addresses were credited to user accounts.

Users must verify current deposit addresses inside the app, as legacy addresses remain a point of failure. ZachXBT advised withdrawing funds until monitoring of residual systems improves. CoinDCX warned of phishing campaigns tied to the event.

Security Practices and Remaining Risks

Legacy infrastructure management and deposit address hygiene represent ongoing concerns. The sweeping failure allowed funds to accumulate for months before detection. CoinDCX plans to strengthen monitoring of decommissioned systems and continue user education on address verification.

Combined losses across both incidents total approximately $60 million, all covered internally. No timeline for additional compensation measures beyond the existing protection fund has been announced as of October 28, 2026.