CoinDCX has confirmed that an internal wallet management failure resulted in a loss of 15.99 million USDT, equivalent to roughly $16 million. The Indian cryptocurrency exchange initially dismissed reports of suspicious transactions but has now acknowledged the loss and said it will cover the amount itself.

The issue emerged last week after blockchain investigators identified approximately $16 million in unusual transfers involving wallets associated with CoinDCX. CEO Sumit Gupta initially rejected the concerns, describing the reports as a false alarm in a post on X.

In its initial response to CoinDesk, the exchange said the flagged addresses were legacy wallets created in January 2025 and compromised during a security breach in July of that year. The incident reportedly cost CoinDCX around $44 million. The company maintained that the wallets had been decommissioned and were no longer being used.

However, on-chain investigator ZachXBT challenged the exchange’s account, highlighting an address labeled TQKJQ. He said the address was still being used by a liquidity provider and had transferred customer deposits to CoinDCX’s current public hot wallet in April and May 2026.

CoinDCX addressed the matter in a blog post published Sunday, confirming that TQKJQ belonged to its former operational wallet infrastructure. The company said the wallet was compromised during the security incident disclosed on July 19, 2025, and was subsequently retired.

According to the exchange, some users continued depositing funds into these old addresses after they had been taken out of service. CoinDCX said it credited the customers’ accounts when the deposits arrived, while a separate process was responsible for transferring the assets into its main wallet.

This process, known as “sweeping,” was intended to automatically move funds from retired addresses to the primary wallet. A failure in that mechanism during a specific period prevented the transfers from completing, leaving deposits in the old wallet.

CoinDCX said the resulting shortfall amounted to 15.99 million USDT and confirmed that the company had absorbed the loss.

The exchange did not identify the cause of the unusual fund movements, name any party responsible, or characterize the latest incident as a new hack. CoinDesk contacted CoinDCX to clarify whether the old addresses had been compromised again.

The company also stressed that customer funds remain secure in segregated cold wallets, which are protected by multiple custody safeguards and offline security controls. Cold wallets are designed to remain disconnected from the internet.

CoinDCX acknowledged that reviewing the retired wallet infrastructure and establishing the sequence of events took time. It said it could have responded more proactively but published its explanation once it had completed its review and developed a clearer understanding of the incident.