India's largest crypto exchange absorbs $16 million loss from internal process failure tied to retired wallet

Introduction

CoinDCX, the leading cryptocurrency exchange in India, recently disclosed that it incurred a loss of roughly $16 million due to an internal process failure. The loss stemmed from user deposits being sent to a deprecated wallet that had been compromised in a 2025 security breach. While the exchange assures that overall user balances and active trading systems remain untouched, the incident highlights the challenges of managing legacy infrastructure in a fast‑evolving crypto environment.

What went wrong?

• Retired wallet still in use: The wallet in question was part of CoinDCX’s operational infrastructure before a July 2025 hack that forced the exchange to retire several addresses. Despite the deprecation, some users continued to send funds to these old addresses, either out of habit or because the addresses were still visible on the platform.
• Sweeping service failure: CoinDCX’s internal “sweeping” service is designed to automatically move deposits from old wallets to the primary hot wallet. A glitch caused this service to stop functioning for a period, allowing deposits to accumulate in the retired address.
• Resulting loss: The accumulated funds, primarily USDT, amounted to $15.99 million. The exchange chose to absorb the loss rather than pass it on to users.

How CoinDCX responded

1. Public acknowledgment: After initially dismissing reports of suspicious outflows as a false alarm, CoinDCX published a detailed blog post explaining the incident, the role of the retired wallet, and the failure of the sweeping process.
2. Assurance of fund safety: The exchange reiterated that all user assets remain secured in cold, offline wallets that are segregated from operational wallets. No user balances were directly affected.
3. Commitment to transparency: While the exchange admitted it could have communicated the issue more promptly, it emphasized that the update was shared once a full review was completed.
4. Absorbing the loss: CoinDCX decided to cover the $16 million shortfall internally, signaling confidence in its overall liquidity and risk management.

Lessons for the broader crypto ecosystem

• Lifecycle management of wallet addresses: Exchanges must ensure that deprecated addresses are fully removed from user interfaces and that clear guidance is provided to prevent accidental deposits.
• Robust monitoring of internal processes: Automated services like sweeping should have fail‑over mechanisms and real‑time alerts to catch interruptions before they lead to financial loss.
• Transparent communication: Prompt, detailed disclosures help maintain trust, especially when dealing with legacy infrastructure that may still be visible to users.
• Segregated custody: Maintaining a clear separation between operational (hot) wallets and cold storage can protect user funds even when operational mishaps occur.

Closing thoughts

CoinDCX’s decision to absorb the $16 million loss demonstrates a commitment to protecting its user base, but the episode serves as a cautionary tale about the importance of diligent wallet decommissioning and process monitoring. As the crypto industry matures, exchanges that proactively manage legacy infrastructure and communicate openly about incidents will be better positioned to retain user confidence and navigate regulatory scrutiny.