India’s CoinDCX Admits $16 Million Hack After CEO’s Initial Denial Sparks Backlash

Indian cryptocurrency exchange CoinDCX has acknowledged that about $16 million in assets was stolen in a hack.

The company said in an official blog post that attackers breached wallet infrastructure it had used in the past and stole 15.99 million Tether, or USDT, according to The Block on October 25. The wallet had reportedly been discontinued after a hack in July last year, but the company determined that a security vulnerability remained.

CoinDCX said funds piled up in the old wallet after a system that automatically transfers customer deposits to other wallets failed to operate properly for a period. The company said it covered the full loss itself and stressed that customer assets are safely stored in segregated cold wallets. Trading, deposits and withdrawals continue to operate normally.

The incident drew controversy after the exchange initially denied reports of a hack and later acknowledged the loss. Earlier, blockchain analyst Dharshi said on October 21 that about 15.99 million USDT and 5,783 Tron, or TRX, had been transferred from a CoinDCX-linked wallet to an external address.

At the time, CoinDCX co-founder and Chief Executive Officer Sumit Gupta said CoinDCX wallets had not been hacked and argued the alert was false because an address tied to a previous breach had been reused. The exchange’s official account also dismissed the claim as misleading.

On-chain analyst ZachXBT later said the wallet in question had continued to be used to process customer deposits even after last year’s hack. CoinDCX then acknowledged that an operational loss occurred because of an error in its automated transfer system and ultimately disclosed the size of the loss.

CoinDCX was also hit by a roughly $44 million hack in July last year. At the time, the company said the breach stemmed from a compromise of its internal servers. Indian police later said the attack involved a tactic that tricked an employee into installing malicious code.

Separately, ZachXBT criticized CoinDCX management’s initial response and urged users to withdraw their assets. CoinDCX, when asked for comment, only reiterated the position in its official blog and did not explain in detail why it had initially denied the hack.