Indian crypto exchange CoinDCX confirmed a $16 million theft from its platform days after its CEO dismissed breach reports as a "false alarm." The admission brings total losses from two separate security incidents to nearly $60 million.
The latest theft originated from user deposits that accumulated in wallets CoinDCX had retired following a $44 million hack in July 2025. An automated fund-transfer system failed during that incident, and the exchange subsequently took those wallets offline. But incoming deposits continued to land in those same compromised addresses—a critical operational failure.
On-chain investigator ZachXBT publicly contradicted CoinDCX's early denials, forcing the exchange's hand. After CoinDCX confirmed the theft, ZachXBT recommended users withdraw their assets, citing ongoing concerns about the platform's security posture and operational controls.
CoinDCX stated it will cover the $16 million loss and claimed all remaining user funds are safe. That assurance rings hollow: the exchange left user money sitting in wallets it knew were compromised. The pattern—$44 million lost, wallets retired but still receiving deposits, another $16 million gone—suggests systemic failures in asset management and internal controls, not isolated incidents.
