On Oct 21, 2026, about 15.99 million USDT (about $16M) was drained on Tron from deposit wallets at CoinDCX, India's largest crypto exchange. All funds went to one address. The largest transaction was 15,819,002 USDT.
CoinDCX said it had retired the wallets after a hack of about $44M in July 2025. Its CEO initially called the reports a false alarm; the exchange confirmed the loss in a blog post days later. It attributed the loss to a failed internal process for sweeping customer deposits out of retired wallets.
The exchange said some users continued depositing to the old addresses despite notifications.
CoinDCX said it absorbed the loss, credited affected users and that customer balances are unaffected. It said customer assets are held in cold wallets and trading continues. On-chain findings dispute the "retired" description: at least one address was still sweeping deposits in April–May 2026.
Check the deposit address in your exchange app each time you deposit and copy it afresh. Avoid reusing old saved addresses, and follow the exchange's security notices.
