India's largest crypto exchange by registered users, CoinDCX, confirmed on October 25 that it lost 15.99 million USDT from deprecated wallet infrastructure on the TRON blockchain. The admission came two days after CEO Sumit Gupta publicly dismissed initial breach reports as "a false alarm." Block...
"This led to a loss of 15.99 million USDT which was absorbed by the company." — CoinDCX, Official Statement, October 25, 2026
India's largest crypto exchange by registered users, CoinDCX, confirmed on October 25 that it lost 15.99 million USDT from deprecated wallet infrastructure on the TRON blockchain. The admission came two days after CEO Sumit Gupta publicly dismissed initial breach reports as "a false alarm." Blockchain intelligence firm Bitquery traced $9.63 million of the stolen funds to deposit addresses at OKX, Binance, and Gate within 18 hours of the transfer. Tether froze $2.21 million, or approximately 13.8% of the total loss.
The incident marks CoinDCX's second confirmed security failure in 15 months, following a $44 million server breach in July 2025. Combined with WazirX's $235 million multi-signature wallet exploit in July 2024, Indian crypto exchanges have now lost approximately $295 million across three major incidents in 27 months. No federal regulatory framework governs exchange security standards. SEBI and the RBI remain in a protracted jurisdictional dispute over crypto oversight, while an estimated 93 to 119 million Indian users trade on platforms operating under only a tax compliance regime.
On October 21, 2026, blockchain investigator Darcy flagged approximately $16 million in suspicious outflows from wallets previously identified as belonging to CoinDCX. The transfers occurred on the TRON blockchain and involved 15.99 million USDT and 5,783.81 TRX.
CoinDCX's initial response was dismissive. On October 22, CEO and co-founder Sumit Gupta posted on X that early reports of a breach "sounded like a false alarm." The exchange did not issue a formal disclosure until October 25 — four days after the funds moved.
In its eventual statement, CoinDCX attributed the loss to a failure in its automated deposit-sweeping service. The exchange explained that the sweeping mechanism, which routinely moves user deposits from receiving addresses to the exchange's main collecting wallet, had "failed for a particular period." This failure allowed deposits to accumulate in addresses tied to infrastructure the exchange had deprecated following its July 2025 breach. CoinDCX described the affected wallets as "old, deprecated wallet infrastructure which had unknown vulnerabilities."
The company confirmed it absorbed the full $15.99 million loss from its own treasury and stated that customer balances, active wallets, and trading systems were unaffected.
Blockchain intelligence company Bitquery conducted an independent examination of the incident, analyzing activity across 40 TRON wallets linked to CoinDCX. The findings complicated the exchange's narrative.
Bitquery reported that nearly the entire $15.82 million originated from a single deposit address identified as TQKJQ. The investigation found that 88 deposits received between January and March 2026 had remained in this address without being transferred to the exchange's collecting wallet — a period of seven to nine months during which the sweeping service failed to process these funds.
A more concerning finding: all 35 smaller deposit addresses involved in the October 21 transfers had forwarded funds to the exchange after September 1, 2026, with some activity continuing on October 21 itself. This means the compromised infrastructure from the July 2025 breach was still processing user deposits more than a year later, despite being classified as "retired."
The gap between CoinDCX's characterization of the wallets as "deprecated" and Bitquery's evidence that they were actively receiving and forwarding deposits raises questions about the exchange's decommissioning procedures.
The stolen funds followed a familiar laundering pattern. The main transfer of 15,819,002 USDT was split and routed through intermediary wallets before landing at centralized exchange deposit addresses:
| Destination | Amount | Percentage of Total | |---|---|---| | OKX | $5.46 million | 34.1% | | Binance | $2.61 million | 16.3% | | Gate | $1.39 million | 8.7% | | Remaining in wallets (as of Oct 22) | $2.28 million | 14.3% | | Tether frozen | $2.21 million | 13.8% | | Unaccounted | $2.04 million | 12.8% |
Tether blacklisted nine TRON addresses on October 22, preventing movement of 2,212,850.29 USDT. The frozen amount represents approximately 13.8% of the reported loss. The $9.63 million that reached OKX, Binance, and Gate within 18 hours may be partially recoverable depending on those exchanges' cooperation with law enforcement, though recovery timelines for cross-border crypto theft cases typically extend into years.
This is CoinDCX's second confirmed security incident in 15 months.
July 2025 — $44 Million Server Breach: On July 19, 2025, exactly one year after the WazirX hack, CoinDCX disclosed that attackers compromised an internal liquidity account through a server-level exploit. The exchange lost approximately $44 million in various tokens. CoinDCX co-founder Sumit Gupta confirmed at the time that customer funds were held in segregated cold wallets and were unaffected. The exchange absorbed the full loss.
October 2026 — $16 Million Deprecated Wallet Drain: The current incident represents a downstream failure of the July 2025 breach response. The "deprecated" wallets that were exploited had been marked for retirement following the July 2025 incident but continued to receive user deposits for over a year. The failed sweeping service meant funds accumulated in vulnerable infrastructure.
Combined, CoinDCX has lost approximately $60 million across two incidents. According to Tracxn data, CoinDCX's last reported valuation was $2.45 billion as of October 2025, following a direct investment from Coinbase. The exchange has raised $247 million in total funding from investors including Polychain Capital, Bain Capital Ventures, and Coinbase.
Indian crypto exchanges have lost approximately $295 million across three major incidents since July 2024:
| Exchange | Date | Amount Lost | Attack Vector | User Funds Affected | |---|---|---|---|---| | WazirX | July 18, 2024 | $235 million | Multi-sig wallet exploit | Yes — 15% still locked | | CoinDCX | July 19, 2025 | $44 million | Server breach | No | | CoinDCX | October 21, 2026 | $16 million | Deprecated wallet drain | No | | Total | | $295 million | | |
The pattern is notable. WazirX's $235 million loss directly impacted users, with approximately 15% of user holdings still locked in non-tradable Recovery Tokens as of mid-2026. CoinDCX has thus far absorbed both its losses from company reserves, a distinction that matters but does not eliminate the security failure.
India ranked first globally in the Chainalysis 2025 Crypto Adoption Index. The country has an estimated 93 to 119 million crypto users, representing approximately 6.6% of the population. Annual platform transaction volume reached approximately $55 billion in 2026, according to Ken Research, with Q1 2026 retail volume alone at $46 billion per TRM Labs. India's crypto market is valued at $3.61 billion and projected to reach $14.21 billion by 2034.
The ratio of security losses to market size is striking. Approximately $295 million lost from a $3.61 billion market in 27 months produces a loss rate that far exceeds global averages.
India has no federal regulatory framework governing crypto exchange security standards, custody requirements, or proof-of-reserves obligations.
The current regulatory apparatus consists solely of a tax compliance regime: a 30% tax on virtual digital asset (VDA) income and a 1% tax deducted at source (TDS) on transactions. This framework treats crypto as a taxable activity without establishing operational standards for the platforms that facilitate it.
The jurisdictional question remains unresolved. A Parliament finance panel recommended on July 23, 2026, that crypto VDAs be governed through recognized Self-Regulatory Organizations (SROs) formally approved by either SEBI or the RBI. The committee proposed phased regulation before new legislation, with SROs covering exchange governance, transparency requirements, investor protection, and compliance regimes.
However, SEBI and the RBI hold opposing positions. SEBI is expected to act as the primary supervisor for crypto exchanges, focused on market conduct and investor protection. The RBI, according to internal documents reported by Reuters on July 8, 2026, has backed banning private cryptocurrencies entirely. This fundamental disagreement has delayed regulatory action for years.
The consequence: exchanges like CoinDCX and WazirX operate without mandatory security audits, without custody segregation requirements, and without incident disclosure timelines. CoinDCX took four days to confirm a $16 million loss. No regulator required faster disclosure.
The economic value question for India's 93-119 million crypto users is straightforward: the infrastructure they depend on has no mandated security floor.
CoinDCX's $2.45 billion valuation and $247 million in funding suggest a company with resources to maintain wallet infrastructure. That it operated deprecated wallets receiving live deposits for over a year after a $44 million breach points to an operational deficiency that regulation could address — if it existed.
The pattern of initial denial followed by delayed confirmation has repeated across Indian exchanges. WazirX initially characterized its July 2024 incident ambiguously before the full $235 million scale became clear. CoinDCX's CEO called the October 2026 reports "a false alarm" before the company admitted to $15.99 million in losses. In the absence of mandatory incident disclosure rules, the timing and completeness of exchange communications to users remains entirely discretionary.
For users, the practical calculus is risk assessment without adequate data. Proof-of-reserves protocols, mandatory security audits, and real-time incident disclosure requirements are standard in jurisdictions like the EU under MiCA and proposed in the U.S. under the GENIUS Act. India has none of these.
The CoinDCX incident is individually modest — $16 million in losses absorbed by a company valued at $2.45 billion. The systemic pattern is not. Three incidents, $295 million, 27 months, zero regulatory response. India's crypto market ranks first globally in adoption and lacks the institutional infrastructure that adoption demands. The Parliament finance panel's July 2026 SRO recommendation remains unimplemented. Until either SEBI or the RBI asserts jurisdiction and imposes minimum security, custody, and disclosure standards, Indian exchange users bear the full counterparty risk of platforms that self-regulate their own security incident timelines.