CoinDCX Data Breach: What Happened and What to Do

In short: CoinDCX, an India-based crypto exchange, confirmed on October 25, 2026 that it lost 15.99 million USDT — roughly $16 million — from deposit wallets it had stopped using after an earlier 2025 hack, MediaNama reported. CoinDCX says it is covering the loss itself and that customer funds in its cold wallets are unaffected, but the exchange has not identified the attacker or published a list of affected customers.

CoinDCX's CEO called breach reports a "false alarm" on October 22, then the company admitted days later that money had actually disappeared. That reversal, plus the phishing that tends to follow breach headlines, is why affected users need to act now rather than wait for more details.

What happened in the CoinDCX breach?

CoinDCX confirmed on October 25 that it had lost 15.99 million USDT from a deprecated wallet connected to a previous cyberattack, three days after CEO Sumit Gupta publicly denied any breach had occurred, according to MediaNama's reporting. The exchange said a deeper investigation found its automated sweeping service — the system that moves incoming crypto out of deposit wallets into secure storage — had failed for "a particular period" because of unknown vulnerabilities in its old, deprecated wallet infrastructure, letting deposits accumulate in an address that should no longer have been in use.

Suspicious outflows were first flagged by Darcy Niu, co-founder of asset-rescue service FlashRescue, who posted that roughly 15.99 million USDT and 5,783.81 TRX had left CoinDCX wallets and were routed to deposit addresses at Binance, OKX and Gate, The Block reported. This is CoinDCX's second major loss in little over a year: in July 2025 the exchange lost about $44 million after Bengaluru police said hackers posing as recruiters tricked a CoinDCX software engineer into installing malware on a company laptop, giving attackers access to internal systems.

What data or funds were exposed?

What's confirmed is a loss of funds, not a separate personal-data leak. CoinDCX's own blog statement, quoted by both outlets, said the sweeping-service failure "led to a loss of 15.99 million USDT which was absorbed by the company," and that the money came from deprecated deposit-wallet infrastructure tied to the 2025 incident, not from active customer accounts. CoinDCX also said "all user funds remain safe in secure, segregated cold wallets, protected by multi-layer custody and offline security controls," and that ordinary trading, deposits and withdrawals continued as usual, per The Block. Current reporting does not confirm whether account emails, KYC documents or phone numbers were exposed alongside the fund loss — treat that as unresolved.

Am I affected, and what should I do?

CoinDCX says it is crediting affected customers from its own reserves rather than leaving them to absorb the loss, but no report so far gives an exact number or list of which users or wallets were hit. If you hold or have held funds on CoinDCX, assume you could be one of them until the company says otherwise, and work through this checklist:

1. Check your CoinDCX account activity and balance for anything unexpected, and confirm any credit the company has applied to your account.
2. Change your CoinDCX password now, and make it unique — not reused anywhere else. See steps to take if your password was in a breach.
3. Turn on two-factor authentication for your CoinDCX account if it isn't already on.
4. Watch for unsolicited emails, texts or calls referencing your CoinDCX account, balance or this breach — treat them as phishing unless verified independently. See how to spot phishing emails and texts after a breach.
5. Do not click links in unexpected messages about this incident; go to CoinDCX's own site or app by typing the address yourself or using a saved bookmark.
6. Do not hand over one-time codes, passwords or card details to anyone who contacts you about this breach, no matter how official they sound.

What is the phishing risk after this breach?

Breach headlines reliably draw scammers impersonating the breached company. The rule that matters: if a message references your CoinDCX account, balance or personal details, don't act on it — open the app or type the site address yourself, or call a number you looked up, to check, and never hand over one-time codes, passwords or card details to anyone who contacts you first, per Sikkerdigital.dk. For more on weighing claims about stolen data, see what hacker claims about your data actually mean.

Is my account safe with CoinDCX now?

CoinDCX maintains that customer funds held in its cold wallets are safe and that normal trading, deposits and withdrawals have continued throughout. But on-chain analyst ZachXBT publicly challenged the exchange's account and advised CoinDCX customers to withdraw their funds from the platform, The Block reported. When asked about Gupta's earlier denial and ZachXBT's claims, a representative for CoinDCX's PR agency referred reporters back to the company's blog post and did not answer follow-up questions.

What's still not known?

The attacker's identity has not been confirmed. Before CoinDCX acknowledged the breach, it was disclosed publicly by Niu, who is also vice president of global law enforcement cooperation at Web3 security research team Salus, per MediaNama. There is no published list naming which specific customers or wallets were affected, no confirmation of how much of the routed crypto, if any, has been recovered, and no independent confirmation of whether personal account data was exposed alongside the fund loss. Treat any claim beyond these confirmed facts — from CoinDCX or outside researchers — with caution until more detail is published.