CoinDCX: 15.99M USDT Lost From Deprecated, Previously Compromised Wallets

15.99M USDT, per CoinDCX, which says it absorbed the loss.

Root cause: Not yet published. Per CoinDCX: deposits accumulated in deprecated wallet infrastructure compromised in its 19 Jul 2025 incident after a sweeping service "had failed for a particular period". CoinDCX attributes this access to "unknown vulnerabilities".

Timeline, as sourced: Unusual activity noticed 21 Oct 2026; fund movement noticed the next day (per CoinDCX). Update published 25 Oct 04:36 UTC.

India, 21 Oct 2026.

Per CoinDCX (update, 25 Oct (opens in a new tab)): wallet TQKJQ… belongs to old operational wallet infrastructure compromised in the incident CoinDCX reported on 19 Jul 2025 and later deprecated. Some users kept depositing to the old address; CoinDCX credited them and ran a separate service to sweep those funds to its primary wallet. That sweeping service "had failed for a particular period", so deposits accumulated in the deprecated address. After unusual activity on 21 Oct, the loss came to 15.99M USDT, which CoinDCX says it absorbed. CoinDCX says active wallets and trading were unaffected and user funds are in segregated cold wallets.

On 27 Oct CoinDCX warned of a phishing campaign using unofficial notifications and emails (post (opens in a new tab)).

Unknown: how the deprecated wallets were accessed this time (CoinDCX cites "unknown vulnerabilities"), and recovery or freezes.

Pattern: a compromised address stays compromised. Retiring it means it stops receiving, not just that you stop using it.