Cryptocurrency firm CoinDCX has verified a 16 million dollar drain linked to inactive addresses. The information, published by The Block on October 25, 2026, indicates that the affected funds originated from wallets that had been removed from regular operations.
The company's formal confirmation directly contradicts messages issued by its management just days before the announcement.
The incident represents a direct 16 million dollar impact on digital assets stored in inactive addresses, which remained under the firm's custody.
What is known about the theft from retired wallets
The total volume stolen amounts to 16 million dollars, according to data confirmed by The Block. Retired or inactive wallets are cryptographic addresses created previously that have been removed from an entity's routine deposit and withdrawal processing.
Despite being inactive in the exchange's operations, the cryptographic keys for these wallets retained access to residual balances or historical funds. Information released as of October 25, 2026, does not specify which particular cryptoassets make up the drained amount or the exact blockchains where the movements were executed.
Sumit Gupta's shift in stance regarding the breach
The public admission of the loss comes after the executive leadership dismissed initial warnings. Sumit Gupta, CEO of CoinDCX, intervened on the social network X the Wednesday before the confirmation after preliminary reports of a possible breach circulated.
In his public message, Gupta told X users that the initial warnings about an attack sounded like a "false alarm." The subsequent confirmation of the breach highlights a failure in the initial assessment of the technical alerts received by the company.
Pending technical questions following the confirmation
The initial report by The Block does not clarify the specific attack vector used by the attackers to access the 16 million dollars. It is unknown whether the theft was the result of a private key leak, a vulnerability in backups of past infrastructure, or an internal intrusion.
It has also not been specified whether the amount corresponded to customer funds that had not migrated their accounts or if the balance was part of CoinDCX's treasury. The company has not yet detailed the containment measures applied to the rest of the inactive wallets that remain linked to its structure.
The critical control point to monitor focuses on the technical statements or forensic audit reports that CoinDCX may publish to clarify how its inactive addresses were affected.
