On March 11, 2026, CoinDCX’s wallet system moved deposits from 518 Tron addresses in six minutes, according to blockchain intelligence firm Bitquery. One address, already holding more than $9 million, was left behind. By the end of March, 88 deposits worth roughly 15.82 million USDT had accumulated in that wallet. On October 21, the money was taken.
That sequence is the central unanswered question behind a loss CoinDCX has now acknowledged. The Indian crypto exchange said on October 25 that a failure in its automated wallet-sweeping service had allowed deposits to build up in old infrastructure compromised during a July 2025 security incident. It confirmed a loss of 15.99 million USDT, which it said the company absorbed.
A review by BlockBriefing of CoinDCX’s latest explanation, its earlier public response and Bitquery’s published on-chain findings reveals a sharper issue than the headline amount: an address classified as deprecated still received deposits, was part of an automated recovery process and carried a large unswept balance for months.
This report examines public disclosures and previously published transaction analysis. BlockBriefing has not independently recalculated every blockchain transfer or audited CoinDCX’s internal records.
How $15.82 million sat inside a legacy deposit address
CoinDCX says it replaced old operational wallet infrastructure after a security breach in July 2025. But some customers kept sending crypto to previously issued deposit addresses. Instead of rejecting or ignoring those funds, CoinDCX says it credited customers’ balances immediately and used a second, automated process to transfer the received assets into secure wallets.
That second process is called a sweep. Its purpose is simple: keep deposit addresses from accumulating funds that should be held in safer central custody.
Bitquery’s October 23 investigation found that one Tron address, identified by its opening characters TQKJQr, received 88 deposits from January 29 through March 30, 2026. Together, they totaled approximately 15.82 million USDT. The investigation reported that those deposits were not moved out before the October theft.
The most striking comparison came on March 11. Bitquery’s reconstruction indicates that the exchange’s system swept 518 other deposit addresses in about six minutes, while the large balance in TQKJQr remained untouched. The firm also found that later deposits to that address were swept normally after routine wallet activity resumed.
Those observations do not identify the exact software fault. They do, however, make the failure harder to dismiss as a brief, systemwide outage. The public record raises the possibility of a wallet-specific backlog that was not cleared when normal sweeps restarted. CoinDCX has not publicly supplied the internal logs needed to test that explanation.
The contradiction between ‘retired’ and ‘still processing’
When blockchain researchers first flagged the October 21 outflows, CoinDCX said the addresses belonged to old infrastructure exposed in the July 2025 incident. Early public responses portrayed reports of a new loss as misleading. CEO Sumit Gupta described the claims as sounding like a false alarm, The Block reported.
By October 25, the company had provided a fuller account. Its blog post acknowledged that users could still deposit to old addresses and that CoinDCX continued to process those funds through separate crediting and sweeping services. The company also acknowledged that the sweep had failed for an unspecified period.
That distinction matters. An address can be deprecated for new customer use and still receive transactions on a public blockchain. What is at issue is what an exchange continues to do with the funds, who controls the signing keys and how quickly money leaves a known-risk address.
Bitquery reported that 35 smaller deposit addresses hit in the theft had each processed outgoing deposits after September 1, 2026. It also identified repeated small TRX payments used to cover network fees for transfers. The analysis links those routine movements to CoinDCX-associated wallets.
Those findings support continued operational use of the old deposit system, though the underlying wallet labels and transaction attribution come from Bitquery’s analysis rather than an independent BlockBriefing audit. CoinDCX’s revised explanation confirms that legacy-deposit processing existed; it does not explain why the large backlog remained exposed.
From a failed sweep to 40 drained wallets
Bitquery’s research traced the October 21 theft across 40 Tron wallets associated with the exchange. It reported that roughly 15.99 million USDT moved to an attacker-controlled receiving address, with nearly all of it coming from the single wallet holding the 88 unswept deposits.
According to the analysis, just five minutes separated a routine movement involving the wallet system and the first transaction identified as part of the theft. The researchers reported further automated deposit transfers even after the suspicious outflows.
That pattern points to a dangerous overlap: a system still moving deposits and an unauthorized party able to drain assets from part of the same legacy infrastructure.
But it does not prove how the attacker gained access. A leaked signing key, a compromised key store, an inherited infrastructure weakness or another mechanism would require additional forensic evidence. CoinDCX has not publicly disclosed the precise attack path.
Where the USDT went — and what remained
Bitquery reported that about 9.63 million USDT reached addresses it attributed to OKX, Binance and Gate through intermediary wallets within roughly a day. The analysis identified approximately $5.46 million reaching OKX-linked addresses, $2.77 million reaching Binance-linked addresses and $1.39 million reaching Gate-linked addresses.
A transaction reaching an address associated with an exchange does not establish that the exchange took part in the theft. It also does not, on its own, identify the account holder or establish where the funds moved next.
At 12:15 UTC on October 22, Bitquery reported that approximately 2.28 million USDT remained across seven wallets on the attacker’s side. Its published checks found that Tether had not frozen those balances at that time. This is a time-specific snapshot, not a verified current balance or recovery figure.
The funds’ precise status after the researchers’ last update has not been independently verified for this report.
Did customers lose money?
CoinDCX says no. Its October 25 disclosure states that the company absorbed the 15.99 million USDT loss, that customer crypto balances remained accounted for and that trading, deposits and withdrawals continued without interruption. It says customer assets are protected through segregated cold-wallet custody.
Those are important statements from the exchange. They are not a substitute for an independent review of its account ledger, liabilities and asset balances.
The case also raises an accounting question. If users received immediate credit when their deposits arrived at a deprecated address, CoinDCX may have incurred a company-funded shortfall when those funds were stolen. The exact position depends on the timing of user credits, internal reconciliation and the affected accounts. Public blockchain data alone cannot establish those ledger entries.
There is no evidence in the records reviewed that CoinDCX is insolvent or that customers have suffered an uncompensated balance loss. Claims to that effect would go beyond the available evidence.
Five questions CoinDCX still needs to answer
- When did the sweeper fail? The company has not given a precise start time, duration or technical cause for the failure.
- Why did 88 deposits remain unswept? Bitquery found that other addresses were processed during the same broad period, including a large March 11 batch.
- Why could compromised addresses still retain large balances? The exchange continued to support deposits arriving at legacy addresses, but has not published the risk limits used for that process.
- How did the attacker control the keys? On-chain transfers show movement of funds, not the means by which signing access was obtained.
- What became of the remaining and exchange-bound funds? The available statements do not provide a final recovery total or an independent post-incident reconciliation.
Why this failure matters beyond CoinDCX
The July 2025 breach cost CoinDCX about $44 million from an operational account, according to contemporaneous reporting and company statements. The new loss is a separate event with a different publicly described mechanism. It would be wrong to treat the two as one continuing theft without evidence.
What links them is the challenge of retiring compromised infrastructure safely. A wallet address cannot be turned off on a public blockchain. Customers can keep sending it assets long after an exchange changes its app and internal systems. Any recovery service must therefore protect funds while ensuring that a failed transfer does not leave an exposed balance in place.
In CoinDCX’s case, the numbers give that problem a clear shape: 88 deposits, one uncleared balance, months of exposure and a reported 15.99 million USDT loss.
The lesson is not that every old deposit address is unsafe. It is that calling an address retired is not the same as removing the financial risk attached to it.
How this investigation was prepared: BlockBriefing compared CoinDCX’s October 25 public disclosure with Bitquery’s October 22–23 blockchain investigation, contemporaneous reporting of the exchange’s initial response and its July 2025 breach. Wallet classifications, fund-flow amounts and freeze status are attributed to the original researchers. This analysis identifies outstanding questions, not criminal responsibility. Readers can review our earlier October 23 CoinDCX news report for the initial timeline.
