CoinDCX confirmed a loss of roughly $16 million USDT three days after its CEO, Sumit Gupta, disputed reports of a new wallet breach, calling them a false alarm.
It had acknowledged unspecified operational losses from a failed sweeping process on the afternoon of Oct. 22, so the reversal came in two steps, and the full figure arrived Oct. 25.
CoinDCX says it absorbed the loss and that customer balances were unaffected. The sequence, confident public reassurance followed by a confirmed problem, recalls four 2022 collapses whose executives’ statements were later tested in court.
What CoinDCX said and what it confirmed
CoinDCX’s Oct. 25 incident update says it spotted unusual activity on Oct. 21 and learned of irregular fund movements through blockchain data and community reports the next day.
Some customers kept sending deposits to addresses deprecated since the July 2025 breach. CoinDCX credited those deposits immediately, and the automated service that moves them to current wallets stopped working for an unspecified period, leaving the accumulated deposits exposed.
The exchange says trading and withdrawals continued as normal.
Blockchain analytics firm Bitquery counted 40 Tron wallets tied to the transfers on Oct. 23, with $15.8 million traced to one deposit address and $2.2 million reportedly frozen by Tether.
One address had received 88 deposits since March 2026, and about $9.6 million moved on to addresses associated with Binance, OKX, and Gate.
Gupta’s first statement and the later account can coexist, since he contested a breach of current wallets and the loss came through deprecated infrastructure. The gap is in how fully the first message described a system that was crediting deposits to those addresses.
Open points include when the sweeping service failed, how long deposits sat exposed, how the attacker gained control, and whether independent evidence supports the claim that every customer liability stayed covered.
The Oct. 25 statement includes an incident update and omits an audited post-incident balance sheet.
FTX and Celsius
On Nov. 7, 2022, Sam Bankman-Fried posted that FTX’s assets were fine and sufficient to cover customer holdings.
The CFTC’s December 2022 complaint preserved the post and described an internal scramble to raise billions of dollars.
Withdrawals effectively stopped on Nov. 8 once about $6 billion in net withdrawals had left over 72 hours, and FTX filed for bankruptcy on Nov. 11. Customer assets had been diverted to Alameda Research.
A jury convicted Bankman-Fried on Nov. 2, 2023, and sentenced him to 25 years on March 28, 2024. Bitcoin traded as low as about $15,625 on Nov. 9, though other factors drove the decline.
Alex Mashinsky told Celsius users on June 10, 2022, that the company had billions in liquidity, and on June 11 he challenged reports that customers couldn’t withdraw. Celsius froze withdrawals on June 12.
The New York attorney general later alleged on May 25, 2022, a balance sheet deficit approaching $900 million against liabilities near $11.9 billion.
That allegation comes from the state’s complaint and is separate from a finding as of the date of his tweet. Mashinsky pleaded guilty in December 2024 to commodities and securities fraud and received 12 years in May 2025.
Hodlnaut and Voyager
Singapore police charged former Hodlnaut CEO Zhu Juntao on May 26, 2026, with six counts of fraud by false representation.
Prosecutors allege that after TerraUSD collapsed in May 2022, he encouraged employees to deny the company’s exposure and losses and published similar statements in June. Hodlnaut suspended withdrawals on Aug. 8, 2022, and Zhu contested the charges in court, so the case remains at the allegation stage.
Stephen Ehrlich told Voyager customers on June 14, 2022, that the company was well-capitalized and compared the safety of cash held through its banking partner to a bank.
Voyager suspended withdrawals on July 1, 17 days later, once Three Arrows Capital defaulted on a loan of 15,250 BTC and $350 million in USDC, and sought bankruptcy protection on July 5.
The partner bank’s deposit insurance covered the bank’s failure, leaving Voyager’s losses outside it. Ehrlich resolved FTC charges on June 27, 2025, with a $2.8 million settlement and limits on selling retail crypto products.
What separates CoinDCX from the other cases
Three kinds of evidence sit in these histories: what executives said, what records showed independently, and what legal processes later established.
FTX and Celsius ended in criminal findings of intentional fraud, Voyager in a civil settlement, Hodlnaut in a disputed prosecution, and CoinDCX in an admitted operational loss with fraud unestablished.
An assurance can prove wrong because of fraud, a miscalculation, or an incomplete picture, and legal findings separate the two.
CertiK counted $1.28 billion of crypto security losses in the third quarter, up 55.6% from $822.3 million in the second. ESMA launched a supervisory exercise on July 8 covering crypto custodians’ key management, incident response, and third-party dependencies.
If CoinDCX publishes a liability reconciliation, the timeline of the sweeping failure, and an independent review of its legacy wallets, the incident reads as a contained operational failure.
Nominal coverage and immediate withdrawal capacity are separate measures. A hypothetical platform with $1 billion in liabilities and $250 million in liquid assets meets $200 million of redemption requests.
One with $100 million in liquid assets faces a $100 million gap, so reserves have to be read alongside liquidity.
If the account of failure changes again or customer losses surface, the pattern of statements outrunning evidence gains another case.
Customers and markets move faster than audits arrive, and the platforms that can substantiate assurance in the first hours will be the ones whose assurances are believed.