$16M Lost After Exchange's Deposit Sweep Fails

A failure in an automated deposit-sweeping system resulted in a 15.99 million USDT loss at a cryptocurrency exchange. The assets were taken from old addresses that the platform had retired following a security breach in July 2025.

Even though the exchange, CoinDCX, instructed its users to transition to new deposit addresses after the July incident, a cryptocurrency address does not fundamentally expire. Customers could still route money to the old locations by copying them from previous messages, utilizing automated transfers, or relying on saved withdrawal forms. The blockchain processes these transactions regardless of what destination the current app displays.

Faced with this behavior, CoinDCX implemented a design involving a significant trade-off. Refusing to recognize transfers to retired addresses could cause users who reused old instructions to seemingly lose their money. Instead, the exchange chose to instantly credit customer portfolios whenever a deposit hit the deprecated addresses.

An automated sweeping service was then tasked with moving the actual tokens from the outdated infrastructure into newer, secure wallets. Users did not have to wait for this secondary sweep to utilize their credited balances. However, the company’s October 25 disclosure confirmed that this onward transfer mechanism broke down for an unspecified period.

Accumulated Vulnerabilities

Because the sweeping service failed, exchange liabilities increased while the actual coins accumulated in vulnerable wallets. The firm has not specified when this breakdown started, if internal alerts were triggered, the total number of users involved, or why a large, unmoved balance did not force an intervention prior to October 21.

Blockchain analysis by Bitquery examined the incident on the TRON network, identifying 40 drained wallets. Out of the 15.99 million USDT lost, the study found that 15.82 million USDT sat in a single deposit address. Bitquery noted that this primary address held 88 deposits originating from one depositor, with no outward movement recorded since March.

Additionally, Bitquery tracked small TRX payments, which are necessary to cover network fees for moving USDT on TRON, arriving at the affected addresses. These top-ups were followed by routine transfers, with activity recorded on October 21.

Detection and Recovery

CoinDCX reported observing unusual system activity on October 21, which was followed by irregular onchain movements the next day and community reports that sparked a deeper investigation. Initially, a dispute emerged on October 22 regarding whether the wallets were completely inactive. Investigators highlighted continuous movements between the old addresses and operational wallets, leading the exchange to clarify that a recovery workflow was still actively handling deposits there.

Because CoinDCX credited users as soon as deposits arrived, it assumed responsibility for securing the underlying tokens. When the assets vanished from the old infrastructure, the company absorbed the 15.99 million USDT loss. The exchange stated that replacement funds were supplied to ensure customer balances, active wallets, and trading operations experienced no impact.