Yes, CoinDCX has confirmed a loss. In October 2026 the Indian exchange said that 15.99 million USDT, about $16 million, was lost from deprecated wallets after an automated sweeping service failed. Its CEO first called reports of a breach a "false alarm". A blog update around 25 October then confirmed the loss, said the company had absorbed it, and said user funds sit in segregated cold wallets.
According to the company, customers did not lose money in this incident. It is the second time in about fifteen months that CoinDCX has reported a loss from its own wallets: in July 2025 it lost about $44 million from an internal operational account. This post sets out the facts as reported, explains what a "retired wallet" is in plain words, and lists the habits that protect you on any platform, including the one I co-founded.
Why I am writing this, and what I will not do
I co-founded Unocoin in 2013. CoinDCX is a competitor. So let me be clear about the rules I am following here.
I am not going to gloat. I am not going to tell you this could never happen on Unocoin, because no honest operator can promise that. And I am not going to speculate beyond what has been reported. Every exchange that has been around long enough has had bad days. What I can do is explain what this kind of incident means, because as an operator I know where losses tend to hide. Usually not in the exciting parts. In the boring plumbing.
What CoinDCX said, and when
Here is the sequence as reported by The Block on 25 October 2026:
- Reports of a breach at CoinDCX circulated.
- CoinDCX's CEO initially described the breach reports as a "false alarm".
- Days later, in a blog update, the company confirmed that 15.99 million USDT had been lost from deprecated wallets after an automated sweeping service failed.
- The company said it had absorbed the loss, and that user funds are held in segregated cold wallets.
That is the extent of what has been confirmed. I would treat anything beyond it, on social media or in group chats, with caution until the company or a credible outlet reports it.
How a retired wallet lost 15.99 million USDT
In general terms, exchanges use many wallets. Some hold customer deposits. Some handle daily operations. Over time, systems change, and older wallets get "retired" or "deprecated": the exchange stops using them for new activity.
But a retired wallet may still receive funds, for example from a user sending to an old deposit address. So exchanges run automated "sweeping" services that regularly move anything that lands in old wallets into the wallets currently in use.
That kind of plumbing is invisible when it works. When it fails, funds can sit in places nobody is watching closely. CoinDCX has said the loss came from deprecated wallets after a sweeping service failed. It has not, in what I have read, published a full technical post-mortem, so I will not guess at the exact mechanism.
The general lesson for operators is old and boring: every wallet you ever created is part of your security surface, including the ones you stopped thinking about. The general lesson for users is that the inside of an exchange is complicated, and you cannot see it.
The July 2025 incident, briefly
In July 2025, CoinDCX lost about $44 million from an internal operational account. The company said customer funds were not affected and that it absorbed the loss. Bengaluru police later said the attackers had posed as recruiters and got an engineer to install malware.
That detail matters beyond CoinDCX. A fake job offer is an attack on a person, not on code. Anyone in crypto, at any company, is a target for this kind of social engineering. And the same tricks are used on ordinary users every day: fake support agents, fake job offers, fake "verification" requests.
The biggest Indian incident remains WazirX in July 2024, when a breach of a multisig wallet caused losses of over $230 million, about 45% of user funds, and trading and withdrawals were halted. In that case, users were affected, and a court-approved restructuring scheme followed in 2025.
Were customer funds affected?
CoinDCX has said no, for both the 2025 and 2026 incidents: the losses came from the company's own wallets, it absorbed them, and user funds are held in segregated cold wallets.
I have no information beyond what the company has published, and I would not ask you to trust me on someone else's internals any more than I would ask you to trust a competitor on ours. What I would say is this: a company absorbing a loss is the right outcome for users, and the fact that it can absorb it is worth something. But the reason you should care about custody is not any single incident. It is that, on any exchange, you are relying on systems you cannot inspect.
India's crypto sector is unregulated as an asset class, and there may be no regulatory recourse for a loss. Your own habits are the part of the system you control.
Watch for scams that ride on the news
Every exchange incident brings a second wave of messages, and they are almost always fake. Someone claims to be from the exchange and offers to "verify" your account. Someone promises "compensation" if you connect your wallet or share a code. Someone in a Telegram group offers to recover funds for a fee. None of these are real. An exchange will communicate through its own app, website and official channels, and it will never ask for your OTP, password or seed phrase.
If you are worried about your account on any platform, log in through the official app you already have installed, check your balance and history, and contact support only through the details on the official website. If you have already shared something you should not have, act fast: change your password, contact the platform, and if money has moved, call 1930 and file at cybercrime.gov.in.
Habits that protect you on any platform
- Know where your Bitcoin is. On an exchange, you hold a claim; in your own wallet, you hold the keys. Learn how to withdraw to a wallet you control, and practise with a small amount.
- Keep on any exchange only what you are actively using. Think about holding longer-term savings in self-custody once you are comfortable with seed phrases.
- Read a platform's own disclosures about how it holds assets, and be clear about which claims are independently verified and which are the company's own statements. For Unocoin, it states 95% of assets are in cold storage with multi-signature wallets; that is Unocoin's own statement, and there is no independent public attestation of it on this site.
- Turn on two-factor authentication everywhere.
- Treat every unexpected message as a possible attack, including job offers and "support" calls. Never share your OTP, password, PAN or seed phrase. Real support never asks.
- Download your transaction history regularly. If anything ever goes wrong, you will need it for both recovery and tax.
- Use platforms registered with FIU-IND, and remember that registration is about anti-money-laundering duties, not a guarantee of safety.
If you move Bitcoin to your own wallet, our self-custody and tax guide covers what to record.
Incidents like this one will keep happening across the industry. The people who come through them calmly are the ones who already knew where their coins were. Run our checklist on whatever platform you use today, ours included.
Common questions
Was CoinDCX hacked in October 2026?
CoinDCX confirmed around 25 October 2026 that 15.99 million USDT, about $16 million, was lost from deprecated wallets after an automated sweeping service failed. Its CEO had first called breach reports a false alarm.
Did CoinDCX users lose money?
CoinDCX said it absorbed the loss and that user funds are held in segregated cold wallets. That is the company's statement; no further detail had been confirmed in the report we read.
What is a retired wallet?
A deprecated or retired wallet is one an exchange no longer uses for new activity. Funds can still arrive at old addresses, so exchanges run automated sweeps to move them into active wallets.
How do I protect my crypto on an exchange?
Turn on 2FA, keep only what you actively use on any exchange, learn to withdraw to a wallet you control, read the platform's custody disclosures, and never share your OTP, password, PAN or seed phrase.