CoinDCX, India's largest crypto exchange by trading volume, says it absorbed a $15.99 million loss in USDT after an internal process failed to move customer deposits out of a retired wallet.

The wallet, labeled TQKJQ, belonged to the exchange's old operational infrastructure, which was compromised in the July 19, 2025 security breach that cost the exchange about $44 million and was deprecated as a result.

Some users kept sending funds to the old addresses even after deprecation; CoinDCX credited those users' portfolios when the funds arrived, but a secondary service meant to sweep deposits into the primary wallet failed for a period, letting value accumulate in the compromised address.

The reversal is the story.

When blockchain sleuths flagged roughly $16 million in suspicious outflows from wallets linked to the Mumbai-based exchange last week, CEO Sumit Gupta dismissed the reports as a false alarm on X, and a spokesperson told CoinDesk the cited addresses were old ones from January 2025 that CoinDCX had not used since.

But on-chain investigator ZachXBT pushed back, noting that at least one address was in active use by a liquidity provider and swept user deposits to CoinDCX's current public hot wallet as recently as April and May 2026.

Days later, the exchange published a blog post conceding the loss was real and tied to its retired infrastructure.

CoinDCX's blog post stops short of calling the incident a hack and does not say who was behind the irregular fund movement or how it happened — a gap CoinDesk has flagged by asking the exchange directly whether the old, retired addresses were compromised a second time.

The exchange says the loss was 'absorbed by the company' and that all user funds remain safe in secure, segregated cold wallets protected by multi-layer custody and offline security controls.

It also admits the disclosure came slowly: 'It took us some time to do the thorough review of the deprecated infrastructure... We could have been more proactive.'

CoinDCX says it will strengthen monitoring and controls around its deprecated systems.

The episode also shows how fast an exchange's credibility test has shifted: a denial on X lasted only days before on-chain sleuths forced a full accounting, and the exchange conceded its communication could have been faster.

The incident lands amid a broader compliance push on the identity of crypto businesses.

FinanceX Magazine reports that Worldbox Business Intelligence has launched a registry-sourced dataset of virtual asset service provider company profiles, because blockchain analytics trace where funds moved but cannot establish who owns or controls the company running the service.

FATF's July 2026 update found 83% of surveyed jurisdictions now have Travel Rule legislation, yet almost half of those have taken no related supervisory or enforcement action — a gap that turns exchange incidents like CoinDCX's into questions about entity-level accountability, not just on-chain forensics.

The exchange's loss lands during a skittish week for prices. AK&M reports that Bitcoin decreased by 0.37% on Binance on October 25 with trading volume of $942 million, opening October 26 at $80,154.09.

CoinDesk's site snapshot showed BTC at $79,806.85, down 0.66%, with ETH at $2,307.55 and traders de-risking ahead of Wednesday's Fed decision.

For CoinDCX, the next steps are clearer controls around deprecated infrastructure — and a public still waiting to hear whether the retired addresses were, in fact, compromised a second time.