CoinDCX's Retired, Compromised Deposit Addresses Kept Receiving Funds: Five Steps to Close Out an Incident

On October 22, on-chain researchers flagged roughly $16M leaving addresses linked to Indian exchange CoinDCX, including about 15.8M USDT on Tron. CoinDCX first denied a breach, then issued an update: these deposit addresses were generated earlier in 2025, their keys were exposed in the July 2025 incident, and they had since been retired. Some users nevertheless kept depositing to them.

CoinDCX says a process meant to sweep such deposits regularly failed for a period. It will absorb the operational loss, affected deposits have been credited to users, and its current addresses and cold wallets are unaffected. According to security researchers, one of the old addresses was still being topped up for fees and forwarding funds in 2026. The actual loss and how long the failure lasted have not been disclosed.

Where small teams are exposed

Five things you can do now

• List every address and key touched by past incidents. Confirm each one has been rotated and is no longer referenced by any system, document or partner
• Put on-chain monitoring on compromised addresses that could still receive funds, and alert the on-call person on any inflow or outflow
• Add a success heartbeat to sweep and consolidation jobs, and alert when they fail repeatedly or stop running
• Before closing an incident, run a close-out checklist covering keys, addresses, APIs, deposit entry points and public notices, with a second person signing off
• Verify before making public statements. Until the facts are clear, say you are investigating rather than denying and correcting later

The sequence of events follows CoinDCX's official statements; the roughly $16M figure is the outflow flagged by on-chain researchers, and CoinDCX has not disclosed its actual loss. This article does not cover attack details.