CoinDCX admits operational losses from deposits to compromised wallets, denies active breach

Operational losses from compromised wallets

Cryptocurrency exchange CoinDCX has acknowledged operational losses stemming from a failed process to secure deposits sent to old, compromised wallet addresses. The company stated that while affected users’ deposits were credited, it did not disclose the amount lost or the duration of the failure.

According to blockchain investigator Darcy, approximately $16 million worth of cryptocurrency was transferred from wallets linked to CoinDCX. These funds were later split across multiple addresses and routed to deposit addresses on exchanges such as Binance, OKX, and Gate. CoinDCX has not confirmed whether these transfers correspond to the operational losses it disclosed.

CoinDCX clarified that the compromised addresses were created in January 2025, breached during a July 2025 hack, and have not been used by the company since. The exchange also confirmed that no funds from its active wallets were compromised, and customer assets held in segregated cold wallets remained unaffected.

Response to security concerns

CoinDCX denied reports of a breach in its active wallets, stating that trading operations continued uninterrupted. The company described claims circulating on social media about certain wallet addresses and transactions as misleading. It also confirmed that its current central and user wallet addresses had not transferred funds to the old, compromised addresses.

Darcy noted that hackers appeared to be reusing the compromised addresses, though CoinDCX emphasized that user deposits to these addresses were credited despite the security failure. The company had previously implemented a process to "sweep" deposits sent to discontinued addresses, but this process failed in the recent incident.

In July 2025, CoinDCX suffered a $44 million cyberattack targeting an internal operational account. The stolen assets belonged to the company’s treasury, not customer funds. Following the attack, the exchange launched a recovery bounty program to trace and recover the stolen assets.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

CoinDCX’s disclosure highlights the lingering risks of compromised infrastructure in crypto operations, even months after a breach. For founders and operators in the space, the incident underscores the importance of not just securing active systems but also ensuring robust processes for deprecated or discontinued addresses. The fact that users continued depositing funds into compromised wallets—despite notifications—also raises questions about user education and the effectiveness of communication during security incidents.

The $16 million in flagged transfers, if linked to the operational losses, suggests that attackers may still exploit old vulnerabilities long after they are publicly known. This could prompt other exchanges to audit their own processes for handling deprecated addresses or dormant wallets. Additionally, the incident serves as a reminder that operational failures, rather than direct breaches, can still lead to significant financial and reputational damage.

Related on Lazyfounder

• More business news