CoinDCX Admits Operational Losses After $16M Old-Wallet Transfers — Startup Funding India, October 2026

Startup funding in India is not the only trust story in town: crypto exchange CoinDCX has admitted operational losses after blockchain investigators flagged about $16 million in transfers from old wallet addresses — while firmly denying a fresh security breach.

What was flagged

On 21 October 2026, investigators flagged roughly 15.99 million USDT and 5,784 TRX moving from addresses linked to CoinDCX to a single TRON wallet, before being split and routed onward to deposit addresses at other exchanges. The largest single transfer was 15.82 million USDT. CoinDCX said the flagged addresses were created in January 2025, compromised in the July 2025 incident in which the exchange lost $44 million, and had not been used by the exchange since.

Where the accounts diverge

Investigator ZachXBT challenged that account, saying one CoinDCX deposit address remained in use by a liquidity provider for 10 months after the July 2025 incident, continuing to route user deposits to CoinDCX's current hot wallet. CoinDCX subsequently said its sweep of old addresses had failed for a period, that it absorbed the resulting operational losses, and that affected users were credited. CEO Sumit Gupta said the matter was under investigation and assured that no user funds will be at loss. Importantly, the $16 million figure is the flagged transfer amount — CoinDCX has not confirmed it as the total loss.

Why it matters beyond crypto

For any founder handling customer funds, the lesson is operational, not just technical: deprecated addresses, keys and endpoints must actually stop receiving value. A migration that is announced but not enforced at the infrastructure level can keep creating exposure months later — and the explanation then has to be given in public, under scrutiny.