CoinDCX Co-Founder Denies New Hack After $16 Million Wallet Alert

HACK OR EXPLOITCoinDCX Co-Founder DeniesNew Hack After $16 MillionWallet Alert64IMPORTANCEACTIVE4NEWS MEDIA4PIECESOct 22, 2026 08:19blockboard.net

Published Updated 3 new reports since it was first published

CoinDCX denied that a new breach drained $15.99 million in USDT from its wallets. Sumit Gupta said the flagged addresses were tied to the exchange before its July 2025 hack and that current wallets were not affected.

What this rests on

Claim by claim, with its source
✓
Gupta said the flagged addresses were compromised in July 2025.
✓
Gupta said no funds from CoinDCX’s current wallets were affected.
✓
A security researcher flagged about $15.99 million in Tether moving out of wallets tagged to CoinDCX.
✓
Sumit Gupta said the addresses belonged to CoinDCX before its July 2025 hack and described the alert as a likely false alarm.

What it means

CoinDCX is still dealing with the aftermath of its July 2025 breach, and this latest wallet alert sits in that context. For exchanges, old addresses can keep producing noise after a security incident, especially when they remain tagged to a platform. The exchange’s co-founder, Sumit Gupta, is the central actor here because he is the one identifying which wallets are old and which remain in use.

For traders and other users, the immediate issue is whether activity on labeled exchange wallets reflects a fresh compromise or leftover exposure from an earlier one. If the flagged wallets were already compromised in July 2025, then the practical task is separating legacy addresses from active treasury holdings. That matters for operational trust in custodial venues such as CoinDCX, where wallet identity and history are part of how users judge safety.

The case highlights a familiar tension in crypto security: public wallet monitoring can improve transparency, but it can also surface alerts that are hard to interpret without exchange context. CoinDCX is not the only firm that has to manage the reputational spillover from old addresses staying visible on-chain after a breach. The wider question is how much confidence the market can place in address labeling when the same wallet history can be read as either an active incident or a stale remnant of one.

Market reaction

BT Bitcoin market event: it is read against the reference from 2 h before to 4 h after the line marks the first headline
published
-0.56 % before publication
-0.42 % after
$82,190price at publication
8series points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

How the story was built

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 22 08:18
+20 min
Oct 22 08:38
BeInCrypto adds
Sharpens the figure: $16M, with quotes
+1 h 10 m
Oct 22 09:27
crypto.news context
Its angle: cryptocurrency, investigator, explanation; with quotes
+1 h 16 m
Oct 22 09:34
Crypto Briefing context
Its angle: challenges, highlights, confidence

Thefts of a similar size

WhenWhat happenedFigure
2.6 years ago Curio Ecosystem incident $16M
2.9 years ago FloorProtocol incident $16M
5.0 years ago Indexed Finance · Price manipulation incident $16M
6.1 years ago Electrum incident $16M
7.8 years ago Cryptopia incident $16M

4217 incidents stored · 250 were as large as this one or larger ($16M)