CoinDCX confirms a 15.99 million USDT loss its CEO called a false alarm

On 21 October 2026 about $16 million in USDT left Tron addresses linked to CoinDCX, one of the largest crypto exchanges in India. The next day its CEO called the reports a false alarm. Less than four hours later the exchange admitted losses, and on 25 October it put the figure at 15.99 million USDT. On 27 October the CEO wrote that the false alarm call was his mistake. We read the statements, the reports and the chain itself. Here is how the week went, what the record shows, and what it means for anyone who funds a crypto casino through an exchange.

Alex Jovanovic: “CoinDCX is an exchange, and this site is about casinos. I am writing about it because for players in India an exchange is often the step between rupees and a casino deposit. If that step leaks $16 million and the boss calls it a false alarm, you should know how the week really went.”

What happened on 21 October

The money moved on the Tron network in the afternoon, UTC. From 12:33 to 15:20, 39 addresses sent about 172,000 USDT in small amounts to one fresh address. At 15:35:54 an older address sent 15,819,002 USDT to the same place in a single transaction. We found that transfer on the chain ourselves.

Over the next twelve hours the receiving address split the money across six new wallets. The largest share was about 7.1 million USDT. By 03:22 UTC on 22 October the address was empty. That was about two hours before anyone posted about it.

CoinDCX later wrote that it “noticed unusual activity in our systems” on 21 October. It said nothing in public that day.

One day of denials, then an admission

All times are UTC.

When	What was said
22 Oct, 05:30	Darcy, an investigator at Salus, posts that about 15.99 million USDT and 5,783.81 TRX left CoinDCX wallets for one address.
22 Oct, 08:10	CEO Sumit Gupta: “CoinDCX wallets are not breached.” The hackers “seem to be re-using the old wallet addresses and this sounds like a false alarm.”
22 Oct, 08:14	The CoinDCX account calls the claims “misleading”. The addresses “have not been used by CoinDCX since” July 2025.
22 Oct, 08:52	Investigator ZachXBT: one of the addresses swept user deposits to the exchange’s current hot wallet in April and May 2026.
22 Oct, 09:59	Gupta: the team is “investigating it further” and “no user funds will be at loss”.
22 Oct, 11:47	CoinDCX: its sweeping process failed “for a particular period” and the losses were “absorbed by CoinDCX”. No figure.
22 Oct, 13:42	ZachXBT: “Withdraw all funds from CoinDCX if you value your assets.”
22 Oct, 22:45	Tether blacklists nine addresses holding 2,212,850 USDT.
25 Oct, 04:36	CoinDCX blog: “a loss of 15.99 million USDT which was absorbed by the company.”
27 Oct, 02:55	CoinDCX warns of a phishing campaign: unofficial notifications and emails urge users to click external links.
27 Oct, 14:45	Gupta calls his false alarm post a mistake made before the team had the full picture.

Gupta opened his first reply with “Thanks for highlighting but this is incorrect”. He said the flagged addresses had been created in January 2025 and lost in the July 2025 hack, and that “none of the CoinDCX funds got compromised”. ZachXBT answered with the dates the address was still at work. By 11:47 UTC the exchange told a different story.

Withdraw all funds from CoinDCX if you value your assets. Its co-founders are clowns running a circus. They publicly and privately denied a theft of its assets occurred meaning they straight up lied or are negligently incompetent.

ZachXBT (@zachxbt) 22 October 2026

Alex Jovanovic: “The first answer came in under three hours and it was wrong. The right one took nearly four more, and the number took three days. A platform that answers that fast is answering from memory. I wait for the second statement, and I read the chain while I wait.”

Five days later Gupta took his first answer back. On 27 October at 14:45 UTC he wrote that he had been working with the team on the root cause, and repeated that CoinDCX absorbed all losses and that active wallets and customer funds were not compromised. He did not say how the money was taken.

The address CoinDCX called retired

The exchange’s case is simple. The addresses were created in January 2025, compromised in July 2025 and never used again. A spokesperson told CoinDesk the activity “does not have any connection with CoinDCX”.

The chain tells a longer story. Every month from March 2025 to January 2026, and again in April and May 2026, the address that sent the 15.8 million forwarded USDT to a wallet ZachXBT calls the exchange’s current hot wallet. We checked the last of those transfers ourselves. They went out on 4 May 2026.

The 15.8 million built up on that address between January and March 2026, almost all of it from a single sender. ZachXBT says a liquidity provider used the address for ten months after the July 2025 hack. The small senders were busy too. Of the 39 that paid into the receiving address, 29 had sent USDT to the same hot wallet earlier in October, and 13 of them did so on 20 or 21 October.

The record does not show who held the keys. CoinDCX has not said whether that hot wallet is its own.

Alex Jovanovic: “An address is retired when nothing flows through it anymore. This one moved money for ten months after the hack. The word retired describes a plan. The chain shows what actually ran.”

CoinDCX’s explanation

The blog post of 25 October says the address “belongs to our old operational wallet infrastructure”, which had “unknown vulnerabilities”. Some users kept sending deposits to it after the 2025 hack. The exchange ran two processes for such deposits. It credited the user’s balance at once. A separate sweeping service then moved the coins into the main wallet.

That second service “had failed for a particular period, causing deposits to accumulate in the deprecated address.” The post does not say how long it was down, how many users were involved, or who moved the money out. It does not use the word hack. It says user funds sit in segregated cold wallets and that trading and withdrawals ran without a pause.

One line in the post is worth reading twice: “Depositing to deprecated addresses is highly risky, and exchanges do not typically take liability for them.” This time CoinDCX paid. The same post says it will remind users that old addresses are kept alive only for a limited time. It closes with an apology of sorts: “We could have been more proactive, but we shared this update as soon as we had the complete picture.”

Alex Jovanovic: “Crediting the user first and moving the coins later is a kind design. It also means your balance can show money that still sits on an old address the exchange itself calls vulnerable. CoinDCX covered it this time. The same post tells you not to count on that next time.”

Where the money went

Blockchain analysts traced the funds to deposit addresses at OKX, Binance and Gate. They put about $5.5 million into OKX, $2.8 million into Binance and $1.4 million into Gate. About $2.4 million was still sitting on fresh addresses when they first reported.

Tether froze 2,212,850 USDT on nine addresses at 22:45 UTC on 22 October, 31 hours after the big transfer. ZachXBT says he helped freeze another six figures for the exchange. More than four fifths of the money was gone before the freeze.

The second loss in 15 months

On 19 July 2025 CoinDCX lost about $44 million from an internal account it used for liquidity on a partner exchange. It blamed “a sophisticated server breach” and covered the loss from its treasury. Bengaluru police later arrested a CoinDCX software engineer. Police said hackers had lured him with part-time work and put malware on his office laptop. He said he did not know about the theft.

The address at the centre of the October loss is a leftover from that hack. Together the two cases cost the exchange close to $60 million.

The year had other trouble. In October 2025 Coinbase invested in CoinDCX at a valuation Gupta put at $2.45 billion. In March 2026, The Block reports, Indian police arrested Gupta and co-founder Neeraj Khandelwal over a fraud complaint. CoinDCX said the complaint came from scammers who copied its website.

What this means if you fund a casino through an exchange

1. Copy a fresh deposit address every time. Take it from the app at the moment you send. Never reuse one from your wallet’s address book or an old transaction. Exchanges and casinos both retire addresses.
2. Send a small test first. Wait until it is credited, then send the rest.
3. Treat the first statement as a first statement. Note the time it was posted and check whether a second one follows.
4. Keep balances small. A credited balance is a promise from the company. Move winnings to a wallet you control. Platforms also close, as MonkeyTilt players found out this month.
5. Expect phishing after a public incident. On 27 October CoinDCX warned users about unofficial notifications and emails that push them to click external links. Open the app yourself instead of following a link. Anyone who offers to recover your funds for a fee is a scammer.
6. Do not count on a freeze. In this case it caught about 14% of the money.

We read the hot wallets of the casinos we review every day, for example on our Duel and Thrill pages. A hot wallet is the float a house keeps to pay withdrawals. It tells you the house can pay today. It does not tell you what the house owes all its players. The CoinDCX case adds one more lesson: the addresses around a hot wallet matter too, and an address a platform calls retired can still carry money. Our review method explains how we read wallets and payouts.

What is still open

• How the money was taken. Nobody has said who held the keys to the old address.
• How long sweeping was down. CoinDCX says only “a particular period”.
• How many users sent deposits to the old address.
• Whose hot wallet. CoinDCX has not confirmed the wallet the old address paid into.
• Reports to the authorities. In July 2025 CoinDCX said it informed CERT-In. For October we found no such statement.
• Coinbase. We found no comment from the investor.

Alex’s verdict

CoinDCX paid the loss, and its users kept their balances. That part of the story ended well. The rest is harder to like. An address the exchange called dead moved money for ten months. A sweeping job failed long enough for 15.8 million USDT to pile up. The CEO called it a false alarm before the checks were done. Five days later he wrote that this “was my mistake, and I own that.” I respect the correction. It came after the losses, the freeze and the blog post, and it still does not say how the money was taken.

For a player the lesson reaches past one exchange. Take a fresh address, test with a small amount, keep balances small, and read the chain when a company says all is well.

I will update this post when CoinDCX explains how the money left the old address. If you deposited to an old CoinDCX address this year, tell us in the comments what support told you.

How we checked: we read the CoinDCX blog posts of 20 July 2025 and 25 October 2026, the posts on X by CoinDCX, Sumit Gupta and ZachXBT up to 27 October 2026, the post by Darcy of Salus as quoted in news reports, and reports by The Block, CoinDesk, Decrypt and MediaNama. The 15,819,002 USDT transfer and the last forwarding transfers of 4 May 2026 were checked on the Tron chain on 27 October 2026. The 39 small senders, the six onward wallets and the freeze details come from published on-chain reads that we did not repeat. Times are UTC. We do not publish wallet addresses.

FAQ

Was CoinDCX hacked in October 2026?

CoinDCX does not call it a hack. It says unusual activity hit old wallet infrastructure with unknown vulnerabilities, and a failed sweeping process left 15.99 million USDT there. It has not said who moved the money or how.

How much did CoinDCX lose?

15.99 million USDT, about $16 million. The largest single transfer was 15,819,002 USDT at 15:35:54 UTC on 21 October 2026.

Are CoinDCX user balances safe?

CoinDCX says the company absorbed the loss, user balances are fully accounted for, and user funds sit in segregated cold wallets. It also says trading and withdrawals ran without a pause.

Did the CoinDCX CEO call it a false alarm?

Yes. On 22 October 2026 Sumit Gupta wrote that CoinDCX wallets were not breached and that “this sounds like a false alarm”. The exchange admitted losses less than four hours later. On 27 October Gupta wrote that dismissing the incident as a false alarm was his mistake.

What is a deprecated deposit address?

An address a platform has stopped issuing to users. Coins sent there may still arrive, but the platform has to move them by hand or by a separate process. CoinDCX warns that exchanges do not usually take liability for such deposits.

Was any of the money frozen?

Tether froze 2,212,850 USDT on nine addresses on 22 October 2026. ZachXBT says he helped freeze another six figures. Most of the money reached other exchanges before that.

How much has CoinDCX lost in total?

About $44 million in July 2025 and 15.99 million USDT in October 2026, close to $60 million together. CoinDCX covered both from its own funds.

Gambling is for adults only and can become addictive. Play only with money you can afford to lose, and read our responsible gambling guide if it stops being fun.