Cryptocurrency Exchange CoinDCX Loses $16 Million in Hack

Indian cryptocurrency exchange CoinDCX has confirmed a significant security breach resulting in the loss of nearly $16 million. The incident occurred due to attackers exploiting weaknesses in the exchange's older wallet infrastructure, which had been slated for decommissioning following a previous hack in July 2025.

According to CoinDCX, the breach was facilitated when an automated service responsible for managing customer deposits between wallets experienced a temporary failure. This malfunction led to funds accumulating in an outdated wallet, creating an exploitable target for malicious actors. The exchange has stated that it will absorb the financial losses, assuring customers that their funds remain secure and that trading, deposit, and withdrawal services were unaffected.

The admission from CoinDCX came after initial reports of the breach were circulating, with CEO Sumit Gupta having previously dismissed them as a false alarm. Blockchain researchers, including Darcy and ZachXBT, had flagged suspicious transactions and questioned the exchange's initial statements, highlighting a lack of transparency in the immediate aftermath of the incident.

In parallel, the cryptocurrency and broader digital asset space has seen several other notable security events this week. Coinbase Ireland was fined 3.25 million euros by Ireland's central bank for failing to adequately protect customer funds and for insufficient oversight of outsourced functions. The regulator found that Coinbase Ireland had shortfalls in segregating customer funds, potentially delaying customer recovery in a worst-case scenario.

Further afield, the Initia blockchain platform experienced a $2.7 million exploit, forcing it to halt operations. The attack reportedly leveraged a previously unknown software flaw in its MoveVM transaction processing system, allowing an attacker to create unauthorized tokens and move assets to other networks. Hardware wallet manufacturer Keystone also disclosed a data breach affecting its online store, exposing customer names, contact details, and shipping information, though sensitive payment data and wallet credentials were not compromised.

Adding to the week's security concerns, the U.S. Department of the Treasury sanctioned 10 individuals and one entity for allegedly facilitating North Korea's revenue generation through fraudulent overseas IT employment schemes. These operations often involve North Korean workers posing as legitimate remote employees to infiltrate foreign companies.

These incidents underscore the persistent and evolving threats within the digital asset ecosystem, ranging from direct financial theft and data breaches to regulatory penalties and state-sponsored cybercrime. The CoinDCX hack, in particular, serves as a stark reminder of the importance of maintaining robust security for all systems, including legacy infrastructure, and the critical need for prompt and transparent communication following security incidents.