CoinDCX confirms $16 million loss from retired wallets days after CEO called breach reports a ‘false alarm’
CEO Sumit Gupta had told X users on Wednesday that early reports of a breach sounded like "a false alarm."
Indian cryptocurrency exchange CoinDCX has confirmed a loss of $16 million linked to compromised retired wallets, a disclosure that came just days after CEO Sumit Gupta publicly dismissed early breach reports as a "false alarm" on X. The exchange acknowledged that funds were drained from wallet infrastructure that had previously been taken out of active service, raising questions about the security protocols governing decommissioned assets.
Gupta's initial response on Wednesday characterized the circulating breach reports as unfounded, a stance that stood in stark contrast to the confirmation that followed within days. The incident adds CoinDCX to a growing list of centralized exchanges that have faced security incidents in recent years, including high-profile breaches at platforms such as WazirX, which lost over $230 million in a 2024 attack attributed to North Korean hackers. CoinDCX is one of India's largest crypto exchanges and holds regulatory registration with the country's financial intelligence unit.
The breach underscores persistent vulnerabilities in how exchanges manage legacy infrastructure, particularly wallets that are retired but may still hold or have held significant balances. Security researchers have repeatedly flagged decommissioned systems as potential attack vectors that often receive less monitoring than active infrastructure.
Observers will be watching for further disclosures from CoinDCX regarding the attack vector, any law enforcement involvement, and what measures the exchange intends to implement to prevent similar incidents affecting its broader wallet ecosystem.
Source: The Block
