What happens to deposits sent to an exchange wallet that’s been retired?
On Sunday 25 October 2026, the Indian exchange CoinDCX said it had lost 15.99 million USDT, roughly $16 million, from deposit wallets it had stopped using after its July 2025 hack. Four days earlier its CEO had called the first reports “a false alarm”. The wallets were retired. The deposits kept arriving. Read by a marketer rather than a security engineer.
15.99m USDT
Plus 5,783.81 TRX, sent to one Tron address, per The Block.
15,819,002 USDT
Then split across deposit addresses at Binance, OKX and Gate.
~$44m
July 2025, after which CoinDCX stopped using the wallets.
CoinDCX
The company says it absorbed the loss and user funds are safe.
What CoinDCX says happened.
In its blog post, CoinDCX said unusual activity on Tuesday 20 October had hit its “old, deprecated wallet infrastructure which had unknown vulnerabilities”. Its automated sweeping service, which moves funds between the exchange’s wallets, “had failed for a particular period”, so user deposits built up at an address the exchange no longer used. That led to the loss of 15.99 million USDT, which the company absorbed.
The on-chain analyst ZachXBT wrote that one of those deposit addresses had been used by a liquidity provider for 10 months after the July 2025 hack, and had swept user deposits to CoinDCX’s current hot wallet as recently as April and May 2026. He also said he had helped freeze six figures of the stolen funds on the exchange’s behalf.
CoinDCX says trading, deposits and withdrawals carried on as normal, and that user funds sit in segregated cold wallets.
The timeline.
Per The Block. Times are US Eastern.
What “retired” means for any exchange.
Retired is an internal label. Customers, market makers and other platforms keep the deposit address they saved. Stopping using a wallet doesn’t stop anyone sending to it.
The sweep is what connects an old address to the live one. While it runs, deposits move on and nobody notices the address is old. When it stops, the money waits on infrastructure the exchange already knew was compromised.
The first public answer is the one people quote. Every headline on this story led with the CEO’s “false alarm” reply, posted within three hours of the first report, rather than the loss figure that came four days later.
Questions.
What did CoinDCX lose?
CoinDCX, an Indian crypto exchange, said it lost 15.99 million USDT, roughly $16 million, from deposit wallets it had stopped using after a July 2025 hack. In a blog post published early on Sunday 25 October 2026 it said the loss was absorbed by the company and that user funds held in its cold wallets were safe, according to The Block.
How did deposits end up in a wallet the exchange no longer used?
CoinDCX said its automated sweeping service, which moves funds between the exchange’s wallets, failed for a period. User deposits therefore built up at an address it no longer used, on old wallet infrastructure it described as having unknown vulnerabilities, according to The Block.
When was the loss first reported?
An analyst at the asset-rescue service FlashRescue flagged the outflows at 1:30 a.m. ET on Wednesday 21 October 2026: about 15.99 million USDT and 5,783.81 TRX had left a CoinDCX hot wallet and several deposit addresses at 11:35 a.m. ET the previous day, all to one Tron address, then split across deposit addresses at Binance, OKX and Gate, according to The Block.
What did CoinDCX say at first?
Less than three hours after the first report, co-founder and CEO Sumit Gupta replied on X that the report was incorrect, that CoinDCX wallets were not breached, and that it sounded like a false alarm, adding that the addresses had been compromised in July 2025. The company’s own account called the claims misleading four minutes later. Later that morning CoinDCX posted that its sweeping process had failed for a period and caused operational losses it would absorb, according to The Block.
What did ZachXBT say?
The on-chain analyst ZachXBT wrote that one of the deposit addresses had been used by a liquidity provider for 10 months after the July 2025 incident and had swept user deposits to CoinDCX’s current hot wallet as recently as April and May 2026. He also said he had helped freeze six figures of the stolen crypto on the exchange’s behalf, according to The Block.
What happened in the July 2025 hack?
The July 2025 hack cost CoinDCX about $44 million. Bengaluru police later said hackers posing as recruiters had tricked a CoinDCX software engineer into installing malware on a company laptop, which gave them access to internal systems, according to The Block.
Is this legal or security advice?
No. It is a marketer’s summary of published reporting, for founders building or marketing exchanges and wallets.
Sources.
The Block, “CoinDCX confirms $16 million loss from retired wallets days after CEO called breach reports a ‘false alarm’” (Zack Abrams, 25 October 2026)
Related: Who checks safeguarding when a crypto firm outsources it? · Who is on the other side of a prediction-market bet? · Crypto marketing compliance
Telling customers their funds are safe?
Twenty minutes, direct with the founder.