CoinDCX has confirmed a 15.99 million USDT loss after an automated process failed to move customer deposits away from wallet infrastructure associated with its July 2025 security incident. In an official October 25 update, the exchange said it absorbed the entire loss while customer balances, active wallets and trading systems remained unaffected. The incident involved USDT on TRON and occurred on October 21.
CoinDCX said customers had continued sending assets to deposit addresses that the exchange considered deprecated after the earlier breach. Those deposits were immediately credited to user accounts, while a separate automated service was supposed to sweep the actual assets into CoinDCX’s current wallet infrastructure. That secondary process failed for an unspecified period, allowing customer deposits to accumulate in infrastructure the exchange already considered vulnerable.
On-Chain Records Challenge the Retired-Wallet Description
CoinDCX described the affected infrastructure as old and deprecated, but public blockchain records complicate that characterization. Bitquery identified 40 drained TRON wallets and found that CoinDCX’s systems were still moving customer deposits through some of them on the morning of the theft. The on-chain evidence indicates that deprecated addresses remained operationally connected to CoinDCX’s deposit-handling process, even if they were no longer displayed as current deposit destinations.
Almost all of the loss came from one address holding approximately 15.82 million USDT accumulated through 88 deposits. Bitquery also found routine sweep activity from other affected addresses shortly before and after the unauthorized transfers. A deprecated customer-facing address was therefore not necessarily dormant infrastructure, because CoinDCX retained a mechanism for recognizing deposits and moving their funds internally.
The episode follows CoinDCX’s July 2025 breach, when an internal operational account used for liquidity provisioning was compromised and approximately $44 million was exposed. CoinDCX absorbed that earlier loss as well. The October event is linked to infrastructure affected by the previous incident, but CoinDCX has not publicly established the precise mechanism by which the latest USDT was taken.
The distinction resembles other incidents where the exact security boundary materially changes the diagnosis. A Trust Wallet browser-extension compromise exposed users through client software rather than the underlying blockchains, while the recent Qubic wallet-seed incident originated in weak key generation. CoinDCX’s confirmed failure sits in wallet lifecycle and operational infrastructure rather than a compromise of TRON itself.
Tether Freezes Part of the Stolen USDT
Investigators traced substantial portions of the stolen assets after the drain. Roughly $9.63 million reached addresses associated with Binance, OKX and Gate within about 18 hours, while Tether subsequently blacklisted nine downstream addresses. The freeze immobilized approximately 2.21 million USDT, or about 14% of the confirmed CoinDCX loss, according to on-chain blacklist records.
Freezing should not be conflated with recovery. Similar distinctions have mattered when NEAR Intents blocked attacker-linked flows and when stolen assets from the Bitget breach moved through external liquidity venues. A blacklisted USDT balance cannot move normally, but ownership and restitution still require separate investigative or legal processes.
CoinDCX also acknowledged that its disclosure could have been more proactive after initially disputing concerns surrounding the wallet activity. The incident leaves two operational questions unresolved: how long the sweep service had failed and how unauthorized actors gained the ability to move funds from infrastructure that CoinDCX continued servicing. The exchange says it will strengthen monitoring of residual systems and more aggressively encourage customers to stop using deprecated deposit addresses.
