CoinDCX confirms functioning of rogue wallets, siphoning user funds worth $16 million

CoinDCX crpyto exchange has confirmed the functioning of a compromised wallet that has siphoned off user funds worth an estimated $16 million since October last year. While the exchange told businessline that no CoinDCX users were affected by the compromised wallets, the operational failure flagged by a third-party user on the internet raises severe concerns about security measures in the crypto space, as per experts.

On Thursday, an X user of the name ‘DracyAri’ flagged that CoinDCX was suspected of having approximately $15.99 million and 5,783.81 TRX stolen. It stated that CoinDCX’s hot wallet and multiple deposit addresses transferred the amount to other multiple other addresses.

While the crypto exchange initially denied the claims, it confirmed the compromised wallet to be connected to last year’s $44 million data breach in July 2025. It also confirmed that some crypto users continued depositing funds into deprecated wallets and its deposit-sweeping process failed for a period.

“Our operational process is designed for regular sweeping of any such deposits made so the funds can be properly accounted for and secured. For a particular period, this sweeping process failed, which got identified today morning. This failure led to some operational losses, which were absorbed by CoinDCX,” it said in a statement on X platform.

Security vulnerabilities and industry impact

When asked about the functioning of the wallet, CoinDCX stated that the encryption key and other details of the wallet were stolen from the exchange, leaving them with no method to deactivate the wallet.

While CoinDCX stresses that all affected users were credited, customer funds remain safe, and active wallets were not compromised, experts like Sharat Chandra, a blockchain and emerging tech evangelist, flagged the blatant vulnerabilities in the crypto space, primarily due to a lack of regulation.

Regulation Needed

“Regulation is very necessary because the players are acting on whims and fancies. We’ll see more of such incidents until there’s regulation in place. If regulations were there systems would be audited by certain empanelled authorities,” he said.

Shortly before the CoinDCX flagging, threat intelligence firm SlowMist said its MistEye system scanned PHP-related assets across the global crypto industry following the disclosure of two critical remote code execution vulnerabilities. The flaws could allow unauthenticated attackers to execute code on affected servers under certain conditions.

“PHP released security patches on October 21, covering versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. SlowMist urged crypto exchanges, DeFi platforms, and wallet providers to assess their exposure and apply the updates promptly,” it said.

Risks and complacency in the crypto market

As the CoinDCX developments continued, Changpeng Zhao, co-founder and former CEO of Binance, shared an X post stating, “No crypto wallet is 100 per cent safe. No software is bug free. No tech is 100 per cent secure. There are risks in everything you do. There are risks if you don’t do anything. There will be issues, setbacks and problems to solve. Stay up-to-date. Manage risks. Solve problems.”

However, Chandra warned that there’s no room for complacency as the response time for addressing these failures narrows. Operational resiliency too can’t be brushed aside by new age fintechs, he said.