CoinDCX confirmed on October 25 that about 15.99 million USDT, roughly $16 million, disappeared from deposit wallet infrastructure it had said was no longer in use.

Three days earlier, on October 22, CEO Sumit Gupta had rejected initial reports of suspicious transfers as "a false alarm," saying the addresses were compromised during the July 2025 attack and were no longer part of active infrastructure.

The exchange said customers kept sending funds to obsolete addresses despite warnings, and an automated system meant to sweep those deposits into secure wallets had malfunctioned, letting balances pile up.

According to Bitcoin News, CoinDCX says customer accounts were credited, cold-storage holdings stayed untouched, and trading and withdrawals continued normally, with the company absorbing the entire loss.

The surprising twist is not the loss itself but the direct challenge to the company's timeline. Per Bitcoin News, blockchain investigator ZachXBT disputed CoinDCX's initial explanation, pointing to evidence that certain addresses remained operational months after the 2025 breach.

Bitquery's independent analysis similarly identified continued wallet activity into October 2026, contradicting the suggestion that the infrastructure had been fully abandoned.

24/7 Wall St. reports that one of the compromised addresses was still directing deposits to CoinDCX's current hot wallet as recently as April and May.

That leaves open the uncomfortable question Bitcoin News raises: how did millions of dollars accumulate in wallets the company had already told users to abandon?

Bitcoin News reports that the latest incident brings CoinDCX's combined 2025 and 2026 security losses to roughly $60 million across two incidents spanning 15 months, following the $44 million breach in July 2025.

Customer funds were covered only because the exchange chose to absorb the loss and had the funds to do so — a courtesy no federal rule guarantees.

24/7 Wall St. notes that crypto on exchanges lacks FDIC insurance in the U.S., and SIPC protections do not extend to cryptocurrencies not classified as securities.

After Mt. Gox collapsed in 2014, the creditor repayment deadline was pushed to October 31, 2027, a wait of about 13 years, while FTX customers were repaid at November 2022 values and missed Bitcoin's subsequent rise.

Both pack articles converge on the same practical lesson: the bigger threat to holders is custody management, not volatility.

24/7 Wall St. points out that Ethereum fell around 44% over the past year, yet holders still own their coins, whereas a customer whose entire $20,000 balance sits on a failing exchange holds only a bankruptcy claim.

A balanced approach splits holdings — a small trading balance on the exchange and the rest in a wallet where the user controls the private keys. Full self-custody removes exchange risk but adds new ones: lose the recovery phrase and the coins may be gone permanently.

Proof-of-reserves reports help, but the outlet cautions they capture only a moment in time and may not reflect other liabilities, and insurance may cover only specific hack types.

CoinDCX has acknowledged it could have communicated the incident sooner, and 24/7 Wall St. argues its handling underscores how prompt, clear disclosure underpins customer trust.

The episode puts fresh attention on how exchanges manage old deposit addresses tied to previous breaches — a category of infrastructure that this case shows can quietly keep receiving money long after being written off.

Regulators elsewhere are tightening the screws on exchange conduct in parallel: Kursiv Media reports that on October 21 the AIFC Court in Kazakhstan barred six platforms, including BingX, bitcoin.com, Huobi Global (HTX), BitMart, Coinbase and WEEX, from offering digital asset services without a license, and that Kazakhstan's AFSA has coordinated with the National Bank on illicit-activity monitoring since May 2026.

For traders deciding how much to keep on a platform, the CoinDCX case offers a working rule from 24/7 Wall St.: holding is generally safe for regular trading, but long-term balances are the exposure. If losing access to an amount for years would be damaging, it is too large to leave on an exchange.