CoinDCX lost $15.99 million in USDT after attackers targeted and drained wallets that were supposedly "retired" following a massive $44 million hack in 2025. While the exchange's CEO initially dismissed reports of the breach as a "false alarm," the Mumbai-based firm later confirmed the loss, bringing its cumulative security-related damages to approximately $60 million. The exchange has stated it will absorb the entire hit to ensure that user funds remain safe and unaffected.
The exploit targeted older infrastructure that was slated for decommissioning but remained vulnerable to unauthorized access. This secondary drain suggests that the threat actors from the previous year’s breach may have retained access or discovered overlooked backdoors in the exchange’s legacy wallet architecture. The incident underscores a significant failure in the exchange's internal migration process, where decommissioned assets were not sufficiently air-gapped or secured against persistent threats.
From a regulatory standpoint, this breach occurs as India tightens its oversight of Virtual Digital Asset (VDA) service providers in 2026. The initial "false alarm" statement from leadership has drawn particular scrutiny from local regulators, who are increasingly demanding transparency and immediate disclosure of security incidents. For US-based observers, this highlights the operational risks inherent in centralized exchanges operating in jurisdictions where mandatory security auditing standards are still evolving.
Market implications are currently centered on the exchange's liquidity and the stability of the Indian crypto ecosystem. While CoinDCX’s commitment to covering the loss prevents an immediate bank run, the reputational damage could lead to an outflow of institutional capital to more secure, internationally regulated platforms. Investors should watch for the results of the upcoming forensic audit and potential regulatory fines that may be imposed by Indian authorities for the communication lapse.
Moving forward, the industry should monitor whether CoinDCX implements a complete overhaul of its custodial technology. The event serves as a stark reminder for DeFi and CeFi users alike that "retired" or "legacy" wallets often represent the weakest link in an organization’s security perimeter. Traders should keep an eye on USDT flow patterns from the attacker's wallets to see if the funds are moved toward mixers or decentralized exchanges.