CoinDCX CEO Called It a 'False Alarm' — $16M Later, India's Biggest Exchange Has a $60M Problem
India's largest crypto exchange just confirmed it lost $15.99 million USDT from wallets it thought were already retired — days after its own CEO told the public there was nothing to worry about.
CoinDCX's announcement this week closes the loop on what many dismissed as rumor or FUD. It isn't. The Mumbai-based exchange is now absorbing two nine-figure hits in under 12 months: a $44 million hack in 2024, and now this. Combined, that's nearly $60 million gone from one of Asia's most prominent centralized exchanges.
What Actually Happened
The funds were drained from wallets CoinDCX had decommissioned following last year's breach. Legacy infrastructure. Wallets that should have been empty or secured. Attackers apparently didn't get that memo.
The exchange says it is absorbing the full loss and that customer funds are not affected. That's the line every hacked exchange uses, and to be fair, CoinDCX has the reserves to back it up — for now. But "we're covering it internally" only holds confidence for so long when the losses keep stacking.
The CEO Problem
What makes this story sharper than a typical exchange hack is the timeline. CoinDCX's CEO publicly called the initial reports a "false alarm." Days later, the exchange confirmed the loss was real. That gap matters. Whether it was premature reassurance or active downplaying, the credibility damage to leadership is real and will linger longer than the financial hit.
This isn't just a security story. It's a trust story.
Why This Matters Beyond India
CoinDCX is the exchange India leaned on as its crypto flagship. It's backed by major venture capital, including Coinbase Ventures. It was supposed to be the institutional-grade answer to a market starved for regulated, reputable infrastructure.
Two major losses in one year reframe that narrative entirely. And with India still finalizing its crypto regulatory posture, a high-profile exchange stumbling this publicly gives regulators exactly the ammunition they need to tighten the screws.
For users on any centralized exchange, especially those operating in emerging markets with thinner regulatory backstops, this is a direct reminder: decommissioned does not mean secured.
What to Watch
Track CoinDCX's next reserve transparency report. If they publish proof-of-reserves soon, they're trying to get ahead of the narrative. If they go quiet, that tells you something else entirely. Users holding funds on smaller Asian CEXs should be watching their own platform's security disclosures this week. Copycats follow confirmed exploits fast.
The $60 million number is real. The "false alarm" is not.