India's largest cryptocurrency exchange by user base, CoinDCX, has confirmed what its own chief executive initially dismissed as a "false alarm" — a loss of 15.99 million United States Dollar Tether (USDT), roughly equivalent to $16 million, drained from a set of wallets the Mumbai-based platform had retired following a devastating hack the previous year. The confirmation not only exposes a troubling gap in the exchange's post-incident security hygiene, it pushes the company's cumulative losses from two separate security breaches to nearly $60 million, a figure that places CoinDCX among the most heavily compromised centralized exchanges in Asia.
The sequence of events surrounding this latest breach is, in some respects, as damaging to CoinDCX's institutional credibility as the financial loss itself. When early signals of the drain began circulating within the crypto-security community, the exchange's chief executive moved quickly to characterize the reports as unfounded — a "false alarm" in his own words. Within days, however, the company reversed course entirely, issuing a formal confirmation that 15.99 million USDT had indeed been siphoned from wallets that were supposed to have been decommissioned. The timeline between dismissal and confirmation is narrow enough to raise serious questions: either the internal incident-response process was too slow to catch what external observers had already flagged, or the leadership team communicated prematurely and without adequate verification. Neither scenario reflects well on an exchange competing for the trust of retail and institutional investors in the world's most populous democracy.
To understand the full weight of this disclosure, context is essential. CoinDCX had already suffered a $44 million hack in the preceding year — a breach serious enough to rank among the more consequential exchange-level security failures in recent South Asian crypto history. In the aftermath of that incident, the exchange undertook a restructuring of its wallet architecture, retiring the compromised infrastructure in what was broadly understood as a necessary step toward operational recovery. The revelation that retired wallets from that very same restructuring process were left in a condition that permitted a subsequent $16 million drain suggests that the remediation efforts following the first hack were materially incomplete. Adding both figures together yields a combined loss of nearly $60 million — a sum that would test the reserves of even well-capitalized exchanges.
CoinDCX has sought to contain the reputational fallout by confirming it will absorb the losses in full, meaning customer funds are not at risk and no user will face a shortfall. This is the correct response, and it should be acknowledged as such. Self-absorption of exchange-level losses is a practice that distinguishes responsible operators from those who socialize their security failures onto their user base. Still, the commitment to absorb a loss of this magnitude is itself a signal that demands scrutiny: the exchange must now demonstrate, with considerably more rigor than it has shown in recent communications, that its balance sheet can sustain nearly $60 million in cumulative security-related write-offs without compromising operational integrity or liquidity buffers.
The broader regulatory environment in India adds a further dimension of complexity. Indian authorities, including the Financial Intelligence Unit under the Ministry of Finance, have been steadily tightening their grip on the domestic crypto sector, with registered exchanges now operating under Financial Intelligence Unit India oversight that mandates Anti-Money Laundering (AML) and Know Your Customer (KYC) compliance. A second high-profile breach at a flagship domestic exchange — particularly one complicated by an initial public denial — is precisely the kind of episode that invites heightened regulatory scrutiny. Whether Indian authorities move to demand third-party audits of CoinDCX's wallet management practices, or use this moment to push for mandatory security disclosure standards across the sector, remains to be seen. But the political appetite for such interventions is unlikely to diminish after this sequence of events.
From a technical standpoint, the mechanism of the attack deserves attention. The wallets in question had been retired — that is, taken out of active operational use — following the prior hack. In theory, retired wallets should carry minimal balances or none at all. The fact that 15.99 million USDT remained accessible within that deprecated infrastructure points to either a failure in the fund-migration process during the post-hack remediation, or an error in access-key management that left private keys associated with retired wallets in an exploitable state. Either explanation suggests a gap between the exchange's stated security posture and its actual operational execution — a gap that, given the scale of funds involved, a mature exchange custodianship framework should have closed long before a second attacker found it.
The incident also arrives at a moment when centralized exchange security is under global scrutiny. Regulators across the European Securities and Markets Authority's jurisdiction, the U.S. Securities and Exchange Commission's purview, and beyond are increasingly conditioning market-access rights on demonstrable custody standards. For CoinDCX, which has ambitions that extend well beyond the domestic Indian market, the reputational mathematics are stark: two breaches, nearly $60 million in combined losses, and a CEO who declared a false alarm days before his exchange confirmed the opposite.
What This Means
CoinDCX's commitment to absorb the $16 million loss protects its users in the immediate term, but it does not resolve the deeper structural questions this breach has surfaced. The exchange must now publish a thorough, technically credible account of how 15.99 million USDT remained exposed in retired wallet infrastructure, and what remediation steps — beyond those already attempted after the $44 million hack — will prevent a third incident. Investors, regulators, and the Indian retail crypto community deserve more than reassurance; they deserve verifiable evidence that the gap between CoinDCX's security commitments and its security execution has been permanently closed. Until that evidence is on the table, the exchange's nearly $60 million in cumulative losses will remain not merely a financial footnote, but an open question about institutional competence at one of emerging Asia's most prominent digital-asset platforms.
Written by the editorial team — independent journalism powered by Codego Press.