TLDR
- Indian cryptocurrency platform CoinDCX suffered a security breach resulting in approximately 15.99 million USDT stolen from deprecated infrastructure.
- The platform confirmed it will absorb all losses, ensuring no impact on customer balances.
- A malfunctioning automated fund transfer system allowed deposits to accumulate in vulnerable legacy addresses.
- Tether has blocked associated addresses, immobilizing roughly $2.2 million of the stolen assets.
- The exchange pledged enhanced oversight of legacy infrastructure and increased user education regarding current deposit addresses.
Major Indian cryptocurrency platform CoinDCX has disclosed a security breach that resulted in the theft of approximately 15.99 million USDT from legacy wallet infrastructure no longer in active use. The platform announced it would fully compensate for the incident, with no financial burden placed on users.
According to the exchange, its primary operational wallets and core trading infrastructure remained secure throughout the incident. User assets continue to be safeguarded in segregated cold storage facilities, while all platform services—including trading operations, deposits, and withdrawals—functioned without interruption.
How the CoinDCX Wallet Hack Happened
The exchange reported detecting suspicious system activity on October 21. According to CoinDCX, protective measures successfully prevented any compromise of active wallet systems or trading platforms.
https://twitter.com/CoinDCX/status/2114214560888888011
The following day, investigators identified abnormal fund transfers through on-chain analysis and user feedback. Further investigation revealed the activity targeted legacy wallet infrastructure with previously undetected vulnerabilities.
This deprecated wallet system had been compromised during an earlier security event on July 19, 2025. Following that incident, CoinDCX decommissioned the affected infrastructure entirely.
Despite the decommissioning, certain users continued directing deposits to outdated addresses rather than updated ones displayed within the application. To prevent user fund loss, CoinDCX maintained processing capabilities for these incoming transactions.
The platform operates a dual-stage process for handling such deposits. Initially, user accounts receive immediate credit upon fund arrival. Subsequently, an automated system transfers—or “sweeps”—these assets into primary secure storage.
According to CoinDCX, this automated sweeping mechanism experienced operational failures over an extended period. Consequently, deposits accumulated within the legacy addresses, creating exposure when the security breach occurred.
The exchange has not disclosed technical specifics regarding how funds were extracted from the compromised wallet. Additionally, no attribution information about the perpetrators has been released.
Tether Freezes Part of the Lost Funds
Reports emerging on October 24 and 25 indicated that Tether had added wallets connected to the fund outflows to its blacklist. As the USDT issuer, Tether maintains the technical capability to restrict wallets holding its stablecoin.
Blockchain security platform AMLBot reported that approximately $2.2 million of the stolen funds had been immobilized. This figure represents roughly 13.8% of the total reported loss.
While a freeze prevents further movement of assets, it does not constitute recovery. CoinDCX would need to verify any actual fund retrieval, and the majority of stolen assets remain unaccounted for.
CoinDCX emphasized that all customer cryptocurrency holdings remain intact and fully reconciled. The platform noted it had maintained continuous operations for 72 hours following the incident, with zero downtime, no withdrawal restrictions, and uninterrupted trading services.
The exchange acknowledged it “could have been more proactive” in public communication. Officials stated they delayed announcements until completing a comprehensive incident assessment.
CoinDCX committed to implementing enhanced monitoring protocols and stricter controls surrounding deprecated systems. The platform also announced plans for regular user advisories emphasizing that legacy deposit addresses maintain only temporary validity.
In its October 25 statement, the company urged users to verify current deposit addresses through the official application or website before initiating any transfers. The exchange cautioned that transmitting funds to outdated addresses carries substantial risk and that platforms typically disclaim liability for such transactions.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
