CoinDCX disclosed that 15.99 million USDT was drained from deposit wallets that the exchange had classified as deprecated. In its on-chain wallet activity update, the company said an automated sweeping service failed for a period of time, allowing customer deposits to accumulate in the old wallet infrastructure.
The exchange said it would absorb the loss and credit the affected user balances. It also said assets held in segregated cold wallets remained safe. The disclosure places the immediate financial burden on CoinDCX rather than on customers whose deposits were held in the affected addresses.
The incident is distinct from a conventional attack on an exchange’s main hot wallet. CoinDCX said the relevant addresses belonged to infrastructure that had already been deprecated. However, the failure of the sweeping process meant that deposits continued to reach, or remain within, wallets that the company believed were no longer in active use.
That distinction matters because the movement of funds was tied to wallet operations rather than a single break-in against CoinDCX’s current custody system. A retired address can still receive blockchain transfers unless deposits are technically blocked, redirected or continuously monitored. If a platform continues assigning such addresses to customers, funds can accumulate outside the controls applied to newer wallets.
A breakdown in wallet retirement controls
CoinDCX’s account indicates that the core failure was operational. The exchange had a system designed to sweep deposits from individual customer addresses into wallets controlled by the company. When that automation stopped working, deposits remained in the older infrastructure.
The company said the deprecated wallets contained vulnerabilities that were previously unknown to it. Those vulnerabilities were then exposed when funds accumulated without being moved into the exchange’s intended custody structure.
This creates several control points for exchanges to review. A platform must know which addresses remain capable of receiving customer funds, whether those addresses are still mapped to active accounts, and whether every incoming transaction is reconciled against an internal ledger. It must also verify that an address marked as retired is actually inactive in practice, rather than simply removed from an operational dashboard.
The financial impact is measurable in stablecoin terms. The loss involved 15.99 million USDT, a dollar-linked asset commonly used for exchange settlement and customer balances. While the company said it would cover the shortfall, the event demonstrates how a technical custody failure can become a direct balance-sheet liability.
On-chain activity challenged the initial explanation
The disclosure followed public scrutiny of wallet activity. ZachXBT criticized CoinDCX’s initial denial and disclosure process in a post about the exchange, alleging that at least one compromised deposit address continued handling customer deposits into April and May 2026. He also urged users to withdraw their funds.
That criticism focused on the gap between CoinDCX’s description of the wallets as unused and the visible movement of funds on the blockchain. If a deposit address was still receiving customer assets or sweeping them into a CoinDCX-linked wallet, its practical status differed from its internal classification as retired.
Bitquery’s on-chain analysis similarly said several deposit addresses remained active after the July 2025 breach. Its analysis found deposits being swept into CoinDCX-linked wallets, but it cautioned that blockchain records alone did not establish whether customer balances were lost or who controlled the wallets that drained the funds.
That limitation is important. On-chain evidence can show when assets moved, which addresses interacted and where liquidity was sent. It generally cannot, by itself, establish the exchange’s internal accounting treatment, the identity of every controller or whether a user balance was ultimately made whole.
Crisis communication became part of the incident
The wallet failure also became a communications problem. Public observers first identified suspicious outflows, while the exchange initially described the relevant wallets as unused after the earlier breach. CoinDCX later acknowledged that the automated sweeping process had failed and that an operational loss had occurred, although its first clarification did not disclose the amount.
The changing explanation increased attention on the exchange’s internal reconciliation processes. For users, the central question was not only whether a wallet had been compromised in 2025, but whether the address continued to receive deposits afterward and whether those deposits were protected by the exchange’s updated controls.
The supplied sources contain CoinDCX’s explanation and criticism from on-chain analysts. No separate opposing response to those specific analytical claims was included in the materials reviewed for this report.
The episode leaves exchanges with a broader custody lesson. Address retirement must be treated as a monitored process, not a label. Platforms need controls that stop deposits to deprecated addresses, detect unexpected activity and confirm that automated sweeping continues to function. They also need reliable reconciliation after a breach, because a wallet that appears dormant internally can still be active on the blockchain, with customer liquidity continuing to flow into it.
Ethan Brooks is not a person. No notebook, no deadlines, no face behind the name — just a byline this newsroom publishes under. Here is the production line underneath it, because a name beside a portrait reads like a journalist, and this one is not one.
The models. Writing: gpt-5.6-luna. Out on the live web: gpt-5.6-luna and gpt-5.6-terra. Pictures: gpt-image-1. Swap one in the newsroom and this line swaps with it — it is read off the machines, not typed here.
How a story is made
- Research. The searching model reads around the story, pointed at primary sources — the filing, the post, the repository — rather than at somebody else's write-up of them.
- Writing. The writing model drafts it against what was found, at Ethan Brooks's usual length and in Ethan Brooks's usual register.
- The loop. A reviewer reads the draft and sends it back with notes. Then reads it again. A piece can go round several times before it leaves the building.
- Enrichment. A quotation has to appear word for word on the page it is taken from. A chart may only use figures that appear in the source it cites. Whatever fails is dropped, and the reason is kept.
- Fact check. A last pass hunts for claims the article makes and its sources do not.
- A human stop. Sensitive subjects are held for a person to read before publication, and a person can kill any of it at any point.
If that sounds less like a newsroom and more like a factory: quite. It is called Press Factory.
This article was generated using AI and published automatically without human pre-publication review.
Read and checked by admin on 10/26/2026
How this article was made
The article was produced by the Grandmonts Media News Engine using automated research, drafting and verification workflows. No human editor reviewed the article before publication. Grandmonts Media remains responsible for the published content. Errors can be reported at office@grandmonts.cz.