CoinDCX Admits Losses After Deposits to Hacked Wallet Addresses Went Unswept, but Denies a Fresh Breach

CoinDCX, one of India's largest cryptocurrency exchanges, has acknowledged suffering losses linked to wallet addresses compromised in a hack more than a year ago, while insisting that its current systems and customer funds remain secure.

In an update on Thursday, October 23, the Mumbai-based exchange said some users had continued to send cryptocurrency to deposit addresses that were compromised in a July 2025 attack, even after being told to use updated addresses on its app and website, Inc42 reported.

CoinDCX said it "sweeps" deposits sent to these discontinued addresses to account for and secure the funds. That process failed for a period, a problem the company identified on the morning of the update. "This failure led to some operational losses, which were absorbed by CoinDCX," the company said.

What CoinDCX says

CoinDCX did not disclose how much it lost or how long the sweeping process had failed. It said all affected users' deposits had been credited, including those sent to discontinued addresses, so customers did not bear the loss.

The exchange said customer assets are held in segregated cold wallets, which are kept offline for security, and that its current central and user wallet addresses were unaffected. No funds from active wallets had been compromised, it said, and trading was continuing as usual.

Chief executive and co-founder Sumit Gupta denied that there had been a fresh breach of the exchange's wallets, saying hackers appeared to be reusing the addresses compromised in 2025. He said none of the exchange's current central or user wallets had sent funds to the old addresses and that the team was still investigating.

The update marked a shift from CoinDCX's initial response, in which it had described claims about certain wallets as misleading.

The on-chain trail

Blockchain investigator Darcy flagged about $16 million in transfers from CoinDCX-linked wallets, according to Inc42. The funds were reportedly split across multiple addresses and routed to deposit addresses on Binance, OKX and Gate. CoinDCX has not confirmed whether these transfers relate to the operational losses it disclosed.

Public blockchains allow anyone to trace the movement of funds between addresses, which is why independent investigators often identify suspicious activity before exchanges announce it. Funds sent to major exchanges can sometimes be frozen if those exchanges cooperate with investigations.

The 2025 hack

The latest episode traces back to July 2025, when CoinDCX lost about $44 million after an internal operational account used to provide liquidity on a partner exchange was compromised. The company said at the time that the stolen assets belonged to its treasury, that customer funds were unaffected, and that it would absorb the losses. It later launched a recovery bounty programme to help trace and recover the funds.

The new disclosure suggests that the consequences of that hack were not fully contained, since compromised addresses remained in use by some customers.

India's troubled crypto exchanges

CoinDCX's troubles echo those of rival WazirX, which suffered a $230 million hack in 2024, one of the largest in the industry's history, and went through a lengthy restructuring before restarting operations. WazirX's founder Nischal Shetty said this week that the exchange is focusing on recovery for customers and creditors and using AI tools in trading, a year after it resumed.

These incidents have damaged trust in Indian crypto platforms and highlighted the security challenges exchanges face. Hackers, including state-linked groups, have targeted crypto exchanges worldwide, exploiting weaknesses in wallet management, third-party integrations and operational security.

The regulatory backdrop

India's approach to cryptocurrency remains cautious. The government imposes a 30% tax on gains from virtual digital assets and a 1% tax deducted at source on transactions, which has significantly reduced trading volumes on Indian exchanges. Crypto exchanges must register with the Financial Intelligence Unit and comply with anti-money laundering rules, but there is no comprehensive regulatory framework for the sector.

The Reserve Bank of India has repeatedly expressed concerns about cryptocurrencies, citing risks to financial stability and monetary sovereignty. RBI Governor Sanjay Malhotra said this month that the central bank would hold the line on crypto while backing tokenisation and distributed ledger technology.

The absence of clear rules on custody, security standards and investor compensation means users of Indian crypto exchanges have limited protections if things go wrong, beyond what exchanges themselves offer.

What users should do

Security experts advise crypto users to always verify deposit addresses directly in an exchange's app before sending funds, never reuse old addresses, and enable all available security features, including two-factor authentication and withdrawal address whitelisting. For larger holdings, many experts recommend self-custody in hardware wallets rather than keeping funds on exchanges.

Users should also be wary of phishing messages and fake support accounts, which often proliferate after security incidents.

How exchanges secure crypto

Crypto exchanges typically hold most customer assets in cold wallets, which are kept offline and are harder for hackers to reach, while keeping a smaller portion in hot wallets connected to the internet to process withdrawals and trades. Deposit addresses assigned to users route funds into the exchange's wallets.

When an address is compromised, exchanges usually issue new addresses and warn users to stop using old ones. But users who save addresses in their wallets or automate transfers may continue to send funds to old addresses. Exchanges then need to monitor and sweep those addresses to protect incoming funds, the process that CoinDCX said failed.

India's crypto user base

Despite heavy taxation, India has one of the world's largest populations of crypto users, according to industry estimates, with millions of people holding digital assets. Many Indian traders have shifted to offshore exchanges to avoid domestic taxes, though authorities have cracked down on unregistered foreign platforms by blocking their websites and requiring registration with the Financial Intelligence Unit.

What comes next

CoinDCX's investigation into the sweeping failure and the flagged transfers is continuing. Users and industry observers will look for a fuller account of what happened, how much was lost and what steps the exchange is taking to prevent a recurrence.

For India's crypto industry, the episode is another reminder that security failures, even when exchanges absorb the losses, erode the trust on which the business depends. Clear communication with users will be essential to rebuilding confidence.