Old wallet addresses trap CoinDCX users, triggering potential losses

CoinDCX said it absorbed operational losses after a process for collecting deposits from old wallet addresses failed, adding a new explanation on Oct. 22, hours after initially denying a fresh breach. The exchange credited affected customer deposit wallets while active wallets remained unaffected.

The statement followed an allegation by ZachXBT that $15.8 million in user deposits was unaccounted for. CoinDCX did not quantify the losses in its update or specify how long the failed process had lasted.

According to CoinDCX, the company had retired the addresses from use after its July 2025 security incident, but some users continued depositing crypto despite earlier warnings. Its sweeping process was supposed to regularly collect those deposits, but it only discovered the failure on the morning of Oct. 22.

Timeline of events

At 9:10 a.m. BST, CEO Sumit Gupta said CoinDCX wallets had not been breached, describing the flagged addresses as compromised in the July 2025 incident. Four minutes later, CoinDCX said the exchange hadn't used those old addresses since July 2025.

At 9:52 a.m. BST, ZachXBT challenged that account, alleging the deposit address TQKJQ remained in use for 10 months after the July 2025 incident and swept user deposits to CoinDCX's current public hot wallet.

TronGrid event data reviewed by CryptoSlate show a successful transfer of 15,819,002 USDT from the address beginning TQKJQ to another TRON address on Oct. 21, confirming token movement but not proving wallet control or customer losses.

Previous incident

The old addresses relate to CoinDCX's July 2025 security incident, which security firm Cyvers linked to the Lazarus Group and resulted in roughly $44 million in losses. At the time, CoinDCX said its treasury covered the loss, with Gupta pointing to social engineering as the cause.

CoinDCX maintained in its Oct. 22 update that customer assets were held in segregated cold wallets and that trading continued normally. The unresolved accounting issue remains how much CoinDCX absorbed and when the sweep process failed.