- CoinDCX warned users about phishing emails and fake notifications that impersonate the exchange and direct users to external links.
- CoinDCX disclosed a $15.99 million loss after an automated fund-sweeping failure left deposits in old, compromised wallet infrastructure.
- The exchange said it would absorb the loss and that customer balances, active wallets and trading were unaffected.
Crypto exchange CoinDCX faces heightened scrutiny following warnings to users regarding a phishing scheme that uses deceptive emails and notifications mimicking the platform to steer recipients toward external links. This alert arrived just one day after the platform revealed a $15.99 million financial loss stemming from a breakdown in how deposits were transferred out of outdated, compromised wallet addresses.
The cryptocurrency exchange noted that similar incidents have impacted other platforms, prompting CoinDCX to collaborate with them on an ongoing investigation. Customers are urged to exercise vigilance regarding communications purporting to originate from the exchange, particularly those requesting account details or directing them to unfamiliar links.
JUST IN:
Crypto exchange CoinDCX warns of an ongoing phishing campaign involving fake notifications and emails impersonating the exchange and directing users to external links.
CoinDCX says other crypto exchanges have reported similar activity and that it is working with them to investigate.
#CoinDCX #CryptoExchange #Security— TheNewsCrypto (@The_NewsCrypto) October 27, 2026
This security alert follows persistent questions regarding the management of deposits sent to wallet addresses that CoinDCX had previously retired following a security breach in July 2025.
CoinDCX Says Failed Sweeping Process Led to $15.99M Loss
In an update released on October 25, CoinDCX reported that it spotted irregular activity impacting wallet infrastructure that had been compromised during the July 2025 security breach. The firm explained that an automated fund-sweeping tool malfunctioned temporarily, causing deposits directed to the older addresses to pile up rather than transferring securely to main wallets.
CoinDCX verified that this malfunction triggered a 15.99 million USDT loss—valued near $16 million—which the organization absorbed directly.
The exchange clarified that despite prior warnings instructing users to utilize the fresh deposit addresses provided via its website and app, certain individuals continued transferring digital assets to the inactive locations. CoinDCX noted that while affected users received proper credit in their portfolios upon deposit arrival, a secondary procedure was meant to route those assets onward to primary wallets.
The company emphasized that customer balances stayed fully accounted for, active wallets remained secure, and normal operations for trading, deposits, and withdrawals proceeded without interruption. Furthermore, customer funds remained safely stored inside segregated cold wallets.
This disclosure came directly after CoinDCX initially refuted allegations that its active wallets had experienced a fresh security breach. On-chain investigators previously pointed out suspicious transfers totaling roughly $16 million in USDT, sparking inquiries regarding activity tied to the older wallet addresses.
CoinDCX has separately advised users to rely on its official communication channels and verify deposit addresses through its app or website. Until the latest phishing notice can be confirmed through a dated primary-source announcement, its specific claims about coordination with other exchanges remain unverified.
Frequently Asked Questions
What caused the $15.99 million loss at CoinDCX?
The loss occurred due to a temporary failure in an automated fund-sweeping service, which left user deposits accumulating in old, compromised wallet addresses instead of moving them to primary wallets.
Were customer balances and active wallets affected by the incident?
No. CoinDCX stated that customer balances were fully accounted for, active wallets remained untouched, and trading, deposits, and withdrawals continued normally. The company absorbed the loss.
Why were deposits going to old wallet addresses?
Some users continued sending cryptocurrency to inactive addresses—which had been discontinued following a July 2025 security incident—despite the exchange advising them to use updated addresses from its app and website.
What should users do regarding the phishing campaign?
CoinDCX advised users to stick to official communication channels, remain cautious of unfamiliar links or account information requests in emails and notifications, and always verify deposit addresses through the official app or website.
