CoinDCX $16 Million Loss: What XRP Holders Should Check
CoinDCX lost about $16 million through old compromised deposit wallets. What went wrong, why it matters for XRP deposits, and a 4-part exchange incident plan.
Key takeaways
- CoinDCX confirmed losing about 15.99 million USDT through old wallets compromised in its July 2025 hack, bringing combined losses to nearly $60 million.
- Never deposit to a saved address: copy the address, and for XRP the destination tag, fresh from the exchange's deposit page every time.
- An exchange's first statement during an incident is rarely the full picture, and 'funds are safe' can still mean withdrawals are paused.
- Do a small withdrawal drill while things are calm so you know the limits, fees and timing before you need them.
- After any hack headline, expect a second wave of scam messages and never click account links sent to you.
CoinDCX, one of India’s biggest crypto exchanges, confirmed on October 25 that it lost about 15.99 million USDT, roughly $16 million. CoinDCX said the money was lost through old wallets compromised in a July 2025 hack, after an automated system meant to sweep stray deposits out of them stopped working. Days earlier, CEO Sumit Gupta had said early breach reports sounded like a false alarm.
The lesson reaches well beyond one exchange. The Bullrunners video uses the incident to argue that “your funds are safe” is a sentence, not a plan. It also argues that anyone who has ever saved an exchange deposit address, including XRP holders, is exposed to the same weak point.
What happened at CoinDCX?
CoinDCX lost about $16 million because customer deposits kept landing in wallets the exchange already knew were compromised. According to the video, the sequence went like this:
- July 2025: CoinDCX was hacked and about $44 million was taken. The exchange retired the compromised wallets.
- After the breach: Some customers kept sending crypto to the old deposit addresses they had saved. CoinDCX ran an automated system that swept anything arriving at those addresses into a safe, active wallet and credited the customer.
- Later: The sweeping system stopped working. The video says the exchange has not spelled out for how long. Deposits began piling up in the compromised wallets.
- Around October 21: An onchain investigator flagged suspicious transfers of about 15.99 million USDT. Gupta suggested attackers might just be reusing old addresses from the 2025 breach and said the report sounded like a false alarm.
- Next: ZachXBT, one of the best-known onchain investigators, challenged that view. He pointed to a wallet he said had kept processing deposits months after the breach.
- October 25: CoinDCX confirmed about 15.99 million USDT had been lost through the old compromised wallet system.
The exchange says customer balances are protected, that it absorbed the loss and that customer funds are held in separate cold storage. According to the video, it also admitted its communication could have been more proactive. Once the loss was confirmed, ZachXBT told customers to withdraw their funds. Across the two incidents, CoinDCX’s losses come to nearly $60 million.
Why do old deposit addresses matter for XRP holders?
Old deposit addresses matter because, in the video’s account, the CoinDCX losses came from deposits sent to addresses that should never have been used again, not from a clever new attack on a live system. The host stresses that the customers weren’t careless. They copied an address once, saved it and reused it, as most people do.
XRP deposits add a second detail to get right. On the XRP Ledger, exchanges usually give many customers the same deposit address. A destination tag, an extra number, tells the exchange which customer to credit. You can read more on what happens if you forget a destination tag.
Many exchanges switch on a ledger setting that rejects any payment arriving with no tag at all. The video notes that this helps, but it cannot protect you from an old tag or an old address. If either one is out of date, wrong or missing, you rely on the exchange to sort it out. Sometimes it can. Sometimes it takes weeks. Sometimes it doesn’t happen.
Is an exchange’s first statement reliable?
An exchange’s first statement during an incident is rarely the full picture. At CoinDCX, the first public reaction was that the report sounded like a false alarm. Days later, the exchange confirmed about $16 million lost. The video is careful not to accuse anyone of lying, because early on even people inside a company often don’t know what happened. That is the point. If insiders don’t know yet, customers certainly don’t.
The video points to a second example from September. Bitget, one of the world’s biggest exchanges, detected unauthorized transfers from some of its wallets on September 24. According to the video, its CEO said user funds were safe. The affected amount was later put at around $387.5 million, and withdrawals were paused while systems were checked. They returned in stages:
- Bitcoin on September 28
- Ethereum the next day
- USDT the day after
- Other tokens, plus fiat and P2P, from October 2
So even if every balance really was safe, holders of those other tokens couldn’t move them for around a week. In the video’s words, “funds are safe” often means “safe but stuck.”
Why do hacks come in waves?
Security problems rarely arrive one at a time. The video argues that the biggest losses often come after a hack rather than during it. It points to several incidents in the same few days as the CoinDCX news:
- The Initia blockchain halted after an exploit involving about $2.7 million in unauthorized token minting. South Korea’s two biggest exchanges, Upbit and Bithumb, flagged its token, and Upbit has blocked deposits and withdrawals of it since October 24.
- On October 26, about $954,000 in Solana was reportedly drained from 49 wallets linked to a Telegram trading bot called Bloom. Bloom’s own statement put losses at about $947,000. It has since blamed an exploited third-party module and promised full refunds.
- Hardware wallet company Keystone said a breach of its web store exposed customers’ names and addresses. No keys were exposed. But names and addresses are what scammers use to send convincing fake security alerts.
That is the second wave. A hack makes headlines, people panic, and then a message arrives saying their account is at risk and they should click to secure it. The host compares it to trading, where the move after the news is often bigger than the news itself. In security, the second wave is scams.
The exchange incident plan: four parts
The video’s main practical contribution is a four-part plan to keep your coins out of the middle of an exchange incident.
Part 1: Know your exchange number. List every exchange you use and roughly how much sits on each. Make a note with columns for exchange, coins and rough value. Then add a fourth column: how you’d get it out, which wallet it goes to, and whether you’ve actually done it. Any exchange where you can’t fill in that fourth column is the one to look at first. If one exchange paused withdrawals tomorrow, you should know within seconds how much is stuck. How much you keep on an exchange is your call, but it should be a decision, not something that just built up.
Part 2: Fresh address every time. Never deposit to a saved address. Open the deposit page and copy the address fresh each time. For XRP, copy both the address and the destination tag fresh. After pasting, check the first and last few characters against the deposit page, because some malware swaps addresses on your clipboard. Then send a small test amount, wait until it’s credited and send the rest. Bullrunners has a guide to making a crypto test transaction. If the deposit page shows a different address than last time, that is normal. Exchanges change them, which is exactly why a saved one is dangerous.
Part 3: Do a withdrawal drill while things are calm. The worst time to learn how to withdraw is mid-incident. Withdraw a small amount to a wallet you control. Note how long it takes, any limits or extra checks, and the fees. For XRP, know in advance that a new XRP Ledger wallet only becomes active once it holds the base reserve. That was 1 XRP at the time of the video, per XRPL.org, and the amount stays set aside. Bullrunners explains why you can’t send all of your XRP. Practice with other coins too, since every network has its quirks.
Part 4: Have incident rules and follow them in order.
- Pause. Don’t click anything in a DM, text or email. Real support doesn’t message you first asking you to secure your account.
- Verify. Type the exchange’s official site or status page address yourself. Check what reputable onchain investigators say, and whether news is coming from real sources or just screenshots.
- Act. If withdrawals are open and you decided in advance you’d move coins in this situation, send them to your tested wallet using the fresh address rule.
Write your rule down now, in your own words. The video’s example: “If withdrawals are open and the exchange confirms a loss, I move everything I’m not actively using.” Yours may differ. What matters is that it’s written before the panic. If withdrawals are paused, there is nothing to rush, and rushing is how people end up on fake recovery sites.
The one-page exchange incident card
The video closes with a card to fill in once, in about 10 minutes:
| Line | Fill in |
|---|---|
| My exchanges | Roughly what’s on each |
| My tested withdrawal wallet | Wallet name, and the last date you actually tested it |
| Deposit rule | I always copy the address fresh, plus the tag for XRP, and send a small test first |
| If an exchange pauses withdrawals | I will: (your rule) |
| Message rule | I never click links in messages about my account. I type the address myself |
What to watch next
For CoinDCX customers, the open question is how long the sweeping system was down. The video says the exchange has not spelled that out. ZachXBT has also said one compromised deposit address was still in use by a liquidity provider for about 10 months after the July 2025 breach. For everyone else, the useful check is personal. Delete any saved exchange deposit addresses and tags, confirm when you last tested a withdrawal, and treat any urgent account message after a hack headline as a likely scam. To plan for the worst case, where an exchange closes rather than gets hacked, see the guide on how to protect coins before an exchange shuts down.
Frequently asked questions
What happened in the CoinDCX hack in October 2026?
CoinDCX said an automated system that moved stray deposits out of wallets retired after its July 2025 hack stopped working, so deposits piled up in those compromised wallets. On October 25 the exchange confirmed about 15.99 million USDT had been lost.
Did CoinDCX customers lose their balances?
CoinDCX says customer balances are protected, that it absorbed the loss and that customer funds are held in separate cold storage. According to the video, the exchange also admitted its communication could have been more proactive.
Why is reusing a saved XRP deposit address risky?
Exchanges change and retire deposit addresses, and on the XRP Ledger many customers share one address identified by a destination tag. The video says that if the saved address or tag is old, wrong or missing, you depend on the exchange to fix it, which can take weeks or may not happen.
What does 'funds are safe' mean during an exchange hack?
The video argues it often means 'safe but stuck'. After Bitget detected unauthorized transfers on September 24, withdrawals were paused and restored in stages, so holders of some tokens could not move them for around a week.
How much XRP does a new XRP Ledger wallet need?
The video says a new XRP Ledger wallet only becomes active once it holds the base reserve, which XRPL.org put at 1 XRP at the time of recording. That 1 XRP stays set aside.
Full video transcript
From the video's captions, lightly formatted. Captions can mishear names and numbers, so check figures against the article above.
There is a crypto exchange hack warning because your funds are safe is not a plan. It's a sentence. And this week, one exchange learned how fast a sentence can change. On the 21st of October, people spotted strange transfers from wallets linked to Coin DCX, one of India's biggest crypto exchanges. The boss said it sounded like a false alarm.
And 4 days later, the exchange confirmed it had lost about $16 million. So, today I'm breaking down what happened, where it went wrong, and the four-part plan I'd use. So, it's never your coins caught in the middle. And there's one detail in this story that applies to every XRP holder who has ever saved an exchange deposit address. And I'll show you exactly what it is.
And stay to the end for a onepage exchange incident card that you can screenshot. Quick disclaimer, education and commentary only, not financial advice. Crypto is volatile and we can and you can lose money. But let's get straight into it.
[music]
Here's what happened in order. Back in July 2025, Coin DCX was hacked. About $44 million was taken. And after that, the exchange stopped using the wallets that had been compromised. It retired those addresses.
But here's the problem. Some customers kept sending crypto to the old deposit addresses anyway because that's the address that they had saved. And to deal with that, CoinDCX ran an automated system. Anything that landed in an old address got swept across to a safe, active wallet and credited to the customer. Then that sweeping system stopped working.
For a period, the exchange still hasn't spelled out. So, deposits started piling up in wallets that were already known to be compromised. And around 21st of October, an onchain investigator flagged suspicious transfers at about 15.99 million USDT. The CEO, Summit Gupta, pushed back. He suggested attackers might just be reusing old addresses from the 2025 breach and said the report sounded like a false force alarm.
Then Zack XBT, one of the best known onchain investigators, challenged it. He pointed to a wallet that he said had kept processing deposits months after the breach. And on 25th of October, Coin DCX put out a statement confirming that about 15.99 million USDT had been lost through the old compromised wallet system. The exchange says customer balances are protected, that it has absorbed the loss, and that customer funds are held in separate cold storage, but it also admitted its communication could have been more proactive, and once the loss was confirmed, Zack XBT told customers to withdraw their funds. Add the two instance together and the losses came to nearly $60 million.
Now, if you're holding $50,000 or more and want help putting this into a proper system, the Oldcoin Pro Accelerator link is at the top of the description and you can get your free crypto portfolio review there. But more on that later. So, no customer balances wiped according to the exchange. But four days were the official line in the onchain story just didn't match. But if you appreciate me making this type of content, let me know by gently tapping that like button.
Now, where did it go wrong? I see three failure points. And every one of them applies to your coins whether you hold them. Failure point one, old addresses that kept working. The money that was lost didn't come from some clever new hack of live system.
It came from deposits that people sent to addresses that should never have been used again. And these people weren't careless. They did what most of us do. They copied an address once, saved it, and then reused it over and over again. And for XRP holders, this is the detail I promised you.
On the XRP ledger, exchanges usually give lots of customers the same deposit address. What tells the exchange which customer to credit is the destination tag. And that extra number. So, when you deposit XRP to an exchange, there are two things you have to get right, the address and the tag. Now, many exchanges switch on a setting that makes the XRP ledger reject a payment with no tag at all.
And that helps, but it can't save you from an old tag or an old address. If either is old, wrong, or missing, you're relying on the exchange to fix it for you. And sometimes they can. Sometimes it takes weeks. Sometimes it just doesn't happen.
Now, failure point two. The first statement is not the full picture. Here, the first public reaction was false force alarm. 4 days later, it was about $16 million lost. Now, I'm not saying anyone lied because early in an incident, even the people inside the company often don't know the full story yet.
But that's the exact point. If the people inside don't know yet, then you and I definitely don't. And this isn't just one exchange. If we go back to September, Bit, one of the biggest exchanges in the world, spotted unauthorized transfers from some of its wallets on 24th of September. The CEO said user funds were safe.
The affected amount was later put around $387.5 million and withdrawals were paused while the system were checked. Then they came back in stages. Bitcoin first on the 28th of September, Ethereum the next day, USDT the day after, and other tokens fear and P2P from the 2nd of October. So even if your funds really were safe, if you held one of the other tokens, you couldn't move it for around a week. But that's what funds are safe often means in practice.
Safe but stuck. Now stay with me because the next one is where I see the most money going missing. And it's after the hack, not during it. Failure.3 is never just one problem at a time. Look at the same few days as Coind DCX.
India, a blockchain network, halted after an exploit that drained around $2.7 million. South Korea's two biggest exchanges, Upbit and Bitum, flagged its token, and Upbe has blocked deposits and withdrawals of it since 24th of October. On the 26th of October, about $954,000 in Salana was reportedly drained from 49 wallets linked to a Telegram trading bar called Bloom. And at the time, the team still couldn't say how. And the hardware wallet company Keystone said a breach of its web store exposed customers names and addresses.
No keys, but names and addresses, exactly what scammers use to send convincing fake security alert. And that's where the second wave of losses come from. The hack hits the headline. People panic, and then a message arrives. Your account is at risk.
Click here to secure your fund and they click. And as a trader, I learned this early. The move after the news is often bigger than the news itself. In markets, it's the second wave of selling. In security is the second wave of scam.
If this is useful, hit subscribe. I break down every big incident like this from a trader seat. So, you know what to check, not just what happened. So, how do you make sure it's never you? Here's the fourpart plan I'd use.
I call it the exchange incident plan. Part one, know your exchange number. Write down every exchange you use and roughly how much you've got sitting on each one. Not to the penny, just honestly. Here's a quick way to do it.
Open a note and make three column. Exchange, coins, rough value. Then add a fourth column, how I'd get it out, which wallet it goes to, and whether you've ever actually done it. If you can't fill out that fourth column in, that's the exchange to look at first. Now, most people can't do this without logging into four different apps.
And that's a problem in itself because if one of those exchanges pause withdrawals tomorrow, you'd want to know in 10 seconds how much of your money is stuck. And as a trader, I treat an exchange like a work bet. I keep what I'm actively using on it. And I know exactly what that is. How much you leave there is your call, but it should be a decision you made, not something that just built up.
Part two, fresh address every single time. Never deposit from a saved address. Every time you send crypto to an exchange, open the deposit page and copy the address fresh. For XRP, copy the address and the destination tag fresh, both of them. And then after you paste it, check the first few and last few characters against the deposit page.
Now, some malware swaps addresses on your clipboard, and checking just takes 5 seconds. Then send a small test amount first. Wait until it's credited, then send the rest. Yes, it costs a tiny fee in a few minutes, but it's the cheapest insurance in crypto. And if the deposit page ever shows you a different address than last time, that's normal.
Exchanges change them. That's exactly why the saved one is dangerous. But this is where a lot of people watching realize they don't actually have a system. They have coins on free exchanges and address saved in a notes app from 2 years ago and no idea what they'd do if withdrawals stopped tomorrow. That's from M.S on Trustpilot, a member of the altcoin pro accelerator.
Now, if your crypto adds up to $50,000 or more, XRP and everything else, this is what the program is built for. You become your own bank and operate from a repeatable system instead of holding and hoping. So, tap the Altcoin Pro Accelerator link at the top of the description to get your free crypto portfolio review. It's a look at how your bag is set up, where your coins are held, and how much is sitting on exchanges, and whether you've got a plan if one of them freezes. It's not someone telling you what to buy, but the link can be found at the very top of the description.
Part three is do a withdrawal drill while things are calm. The worst time to learn how to withdraw is in the middle of an incident. So, do it now. Pick a small amount, withdraw it to a wallet you control, and watch how long it takes. Note any withdrawal limits or extra checks.
Note the fees for XRP. Know this before you need it. A new XRP ledger wallet only becomes active once it holds the base reserve, which is currently one XRP. And that one XRP stays set aside. Now, that's on XRPL.org.
And if you hold other coins, practice those, too, because every network has its own quirks. And once you've done it once, you're not learning under pressure later. Part four, have incident rules and follow them in order. If you hear your exchange might have a problem, here's my order. Pause.
Don't click anything in a DM, a text, or an email. Real support doesn't message you first asking you to secure your account. Verify. Go to the exchange's official site or status page by typing the address yourself. Check what reputable onchain investigators are saying.
Check if the news is spreading from real sources or just from screenshots. Then act. If withdrawals are still open and you've decided in advance that you'd move your coins in this situation, move them to the wallet you've already tested using the fresh address rule. And write that rule down now in your own words. Something like, if withdrawals are open and the exchange confirms a loss, I move everything I'm not actively using.
Now, your rule might be different to the one I just said. The point is that it's written before the panic, not invented during it. So, if drawers are paused, there's no there's nothing to rush. Rushing is how people end up on a fake recovery site. So, let's just recap before we close this off.
What happened? Coin DCX lost about $16 million because deposits piled up in an old compromised wallet after an automatic sweep failed. The first word was false alarm. 4 days later, it was confirmed. The three failure points, old addresses that still work, first statements that aren't the full picture, and problems that come in waves with scammers riding the second wave.
And the exchange incident plan. Part one, know your exchange number. Part two, fresh address every time for XRP address and tag. Do a small test first. Part three, withdrawal drill while it's calm.
Part four, pause, verify, then act. And here's the bonus I promised. The exchange incident card. Screenshot this now. Line one, my exchanges, roughly what's on each, blank.
My tested withdrawal, my tested wallet for withdrawals is blank. Last real date, blank. Line three, I always copy the address. And for XRP, the tag small test first. And finally, if an exchange pauses withdrawals, I will blank.
I never click links in messages about my account. I type the address myself and fill it in tonight, 10 minutes, and next time a headline says funds are safe, you already know what you're doing. And if you want a second pair of eyes on how your coins are spread across exchanges and wallets and your crypto adds up to $50,000 or more, tap the altcoin pro accelerator link at the top of the description and get your free crypto portfolio review. Now, if you want to know what to do when an exchange doesn't just get hacked, but shuts down completely, watch this video next. Thank you very much for watching.
You know what to do. I'll see you at the top. Stay bullish. Peace.
Education and commentary only, not financial advice. Crypto is volatile and you can lose money. Do your own research and speak to a qualified advisor before making investment decisions. Figures and quotes are as reported in the video on October 31, 2026 and may have changed since.
