An Indian exchange absorbs a 15.99 million dollar loss after deposits kept arriving in a retired wallet compromised in 2025 and a service failed to move them out

What happened

India's largest crypto exchange by trading volume says it has absorbed a loss of 15.99 million dollars in the stablecoin USDT, and the cause it describes is not a new break in but an old wallet that was never fully emptied of incoming money. CoinDesk reported on Monday that the loss followed an internal process failure: a service that was supposed to move customer deposits out of a retired wallet did not do so for a period, and deposits accumulated in an address the exchange had already deprecated because it was compromised.

The sequence began last week, when blockchain investigators flagged about 16 million dollars in suspicious outflows from wallets linked to the Mumbai based exchange. The exchange moved quickly to dismiss the reports, with its chief executive calling them a false alarm on a social platform. A spokesperson told CoinDesk that the addresses cited were old ones, created in January 2025 and compromised in the July 2025 hack that cost the exchange about 44 million dollars, and that the exchange had not used them since, so the activity had no connection with the exchange.

That account was challenged on chain. A well known on chain investigator said at least one of the addresses, labelled TQKJQ, was in use by a liquidity provider and swept user deposits to the exchange's current public hot wallet as recently as April and May 2026. On Sunday, the exchange published a blog post on the activity tied to that address and revised its position. The wallet, it said, belongs to its old operational wallet infrastructure, was compromised during the security incident it reported on July 19, 2025, and was deprecated as a result.

The mechanism the post describes is specific, and it is an operational failure rather than a fresh exploit of a live system. Some users mistakenly continued to deposit funds into the deprecated addresses after the exchange retired them following the 2025 hack. The exchange credited those users' portfolios the moment funds reached the deprecated wallet, so from a customer's point of view the deposit worked normally. A secondary service, which the exchange calls sweeping, was then meant to move the funds from the deprecated address into the primary wallet. That process failed for a particular period, causing deposits to accumulate in the deprecated address instead. The result, in the exchange's words, was a loss of 15.99 million USDT, which the company absorbed. The post does not call the loss a hack, and does not say who was behind the irregular movement of the funds or how it happened. CoinDesk reported that it has asked the exchange whether it means the retired addresses were compromised again.

On customer impact, the exchange's position is clear. It reiterated that all user funds remain safe in secure, segregated cold wallets, protected by multi layer custody and offline controls, and CoinDesk's summary records that customers' balances, active wallets and trading systems were unaffected. It also conceded the disclosure point: it took time to complete a thorough review of the deprecated infrastructure and confirm the sequence of events, it could have been more proactive, and it shared the update as soon as it had the complete picture.

Why it matters

This incident is a case study in a risk that security audits rarely price: the long tail of a previous hack. When an exchange retires a compromised wallet, the address does not stop existing, and it does not stop receiving. Customers hold old deposit addresses in saved contacts, in exchange withdrawal whitelists, in documents and in muscle memory, and some of them will keep sending money to an address the operator no longer controls in practice, for months or years. The exchange's own design made that invisible to the senders: because it credited portfolios immediately on arrival at the deprecated address, a user depositing to a compromised wallet saw a normal, successful deposit. The only thing standing between those deposits and loss was a back office sweeping service, and when that service failed for a period, the money pooled in exactly the place an attacker from the 2025 incident would watch.

The disclosure sequence is the second lesson, and the exchange has effectively conceded it. The first public response to investigators flagging about 16 million dollars of outflows was dismissal, a false alarm, supported by a claim that the addresses had not been used since 2025. The on chain record, as the investigator's April and May 2026 sweeping evidence showed, did not support the not used claim in the way it was framed: the addresses were still part of a live deposit route, receiving and forwarding user funds this year. The Sunday post replaced dismissal with a detailed mechanism and an apology for slowness. For users of any exchange, the order of those statements matters as much as their content, because the first statement is the one made when only the exchange knows what happened, and here it was wrong in a way the exchange's own later account corrected.

The absorption of the loss is the third element, and it is genuinely in customers' favour as far as it goes. The company, not its users, bears the 15.99 million dollars; balances were credited and, on the exchange's account, were never at risk in this episode because the deposits had already been recognised in customer portfolios. Absorbing a loss is what a well capitalised operator should do. It does not answer the open questions the reporting leaves: who moved the accumulated funds out of the deprecated address, by what means, and whether the 2025 compromise was used again. CoinDesk's unanswered question to the exchange, whether the retired addresses were compromised a second time, is the factual core still missing, and the answer determines whether this was purely an internal process failure with an opportunistic theft attached, or a continuing compromise that the deprecation failed to close.

There is also a scale point worth keeping in proportion. The 2025 incident cost about 44 million dollars. This one cost about 16 million dollars, more than a third as much again, arising entirely from the residue of the first. An exchange's true cost of a breach therefore includes the years of address hygiene, monitoring and sweeping reliability that follow it, and a failure in that unglamorous layer produced a second eight figure loss without any new system being breached, on the account the exchange itself has given.

What to watch

Watch for the exchange's answer to the question CoinDesk put to it: whether the retired addresses were compromised again. If they were, the incident is a repeat breach of known compromised infrastructure that was still receiving customer money. If they were not, the exchange needs another explanation for how 15.99 million USDT left an address it controlled. Either answer changes the assessment of the first.

Watch what the exchange changes about old deposit addresses. The fixes this incident points to are concrete and observable: disabling crediting for deprecated addresses so a deposit to one visibly fails instead of silently succeeding, alerting users who still send to them, and monitoring sweeping services with the same seriousness as live wallet security. An announcement covering those points would address the mechanism; a general security statement would not.

Watch whether other exchanges disclose similar arrangements. Any large exchange that has survived a hack has retired addresses that may still receive deposits, and the practice of crediting deposits to deprecated addresses while sweeping behind the scenes is unlikely to be unique to one operator. This incident gives every such operator a reason to audit the route, and gives their users a precise question to ask.

And watch for any regulator or auditor response in India. The exchange is the country's largest by trading volume, this is its second eight figure loss connected to the same 2025 compromise, and the gap between its first public statement and its Sunday account is a disclosure issue as well as a security one. Whether any authority treats it that way will shape how quickly the next incident of this kind is disclosed.