CoinDCX Lost $15.99M After Deposits Piled Up in a Deprecated Wallet
A failed automated sweeping service left USDT accumulating inside wallet infrastructure retired after CoinDCX’s 2025 security incident, turning a legacy system into a fresh $15.99 million liability.
W3 Meteor ID: COINDCX-SWEEP-1026202637920
Date & Time: October 25, 2026 — CoinDCX disclosed the 15.99 million USDT loss
Origin: CoinDCX’s automated service for sweeping deposits from deprecated addresses into its active wallet infrastructure failed for an unspecified period.
Visibility: CoinDCX absorbed the loss itself and says customer balances, active wallets, trading, deposits and withdrawals remained unaffected.
Trajectory: After its July 2025 security incident, CoinDCX deprecated the affected wallet infrastructure. Some users nevertheless kept sending funds to old addresses, so CoinDCX credited those deposits and relied on a secondary service to sweep the assets into secure wallets—until that process failed.
Direction: CoinDCX says it will strengthen monitoring and controls around residual systems while pushing users toward current deposit addresses. The larger question for exchanges is whether “deprecated” infrastructure should remain capable of receiving—and indirectly processing—valuable customer assets at all.
Speed: CoinDCX detected unusual activity on October 21 and irregular blockchain movements the following day. Public scrutiny quickly challenged the initial explanation, and by October 25 the exchange had confirmed the failed sweeping process and quantified the loss at 15.99 million USDT.
Magnitude: High operationally, even though customers were reportedly made whole. The incident shows how a failure outside an exchange’s active custody stack can still generate an eight-figure loss when legacy addresses, automated recovery processes and previously compromised infrastructure remain connected.
Altitude: The lesson extends across centralized exchanges, custodians and other Web3 services maintaining old deposit addresses. Retiring infrastructure is not merely a label: every remaining automated bridge to that infrastructure can preserve an attack surface long after the original incident appears closed.
Cock-a-Doodle-Doo: A retired wallet that still receives money is not entirely retired. CoinDCX’s $15.99 million lesson came from the space between decommissioning a system and actually disconnecting it. In W3 Space, yesterday’s infrastructure can become tomorrow’s vulnerability if even one operational thread remains attached.
