CoinDCX has put a nearly $16 million price tag on a wallet incident its CEO initially dismissed as a false alarm.

The Indian exchange confirmed the loss in an October 25 update. It says the missing 15.99 million USDT came from retired infrastructure. The company says it has absorbed the cost and customer balances remain unaffected. Those assurances come from CoinDCX, rather than an independent assessment of its reserves.

The public reversal is a central part of the story. According to The Block, CEO Sumit Gupta initially rejected breach reports before the exchange acknowledged losses. Blockchain investigator ZachXBT challenged that account. The publication connects the affected infrastructure to CoinDCX's roughly $44 million hack in July 2025. That history makes the distinction between retiring a wallet and eliminating its remaining exposure especially important.

How a retired wallet still held money

In its official update, CoinDCX dates unusual activity to October 21 and irregular fund movement to the following day. It says some users continued depositing to old addresses. Customer accounts received credits when those transfers arrived. A separate sweeping process was supposed to move the tokens into secure wallets. The company says that process failed for a period, allowing funds to accumulate.

That explanation separates two things customers can easily mistake for the same event. A balance appearing in an exchange account does not, by itself, demonstrate that the underlying tokens have reached their intended storage location. Here, the exchange describes a gap between crediting balances and moving assets. Closing that gap requires operational controls as well as instructions to use new addresses. Calling infrastructure retired offers little comfort if it can still receive valuable deposits.

The questions the loss leaves behind

CoinDCX says trading, deposits and withdrawals continued normally. It also says user assets are held in separate cold wallets and acknowledges that its communication could have been more proactive. The update does not establish who carried out the theft. Nor does a statement about uninterrupted services independently resolve the security investigation. Customers need a clear account of the failed process, the length of the exposure and the checks introduced to prevent a repeat.

For users making another deposit, the exchange's immediate instruction is to check the current address in its app or website every time. An address saved from an earlier transfer can outlive the system that was meant to handle it. The broader issue is whether CoinDCX can demonstrate that obsolete infrastructure no longer leaves money exposed. Its promised absorption of the loss addresses who pays for this incident. A detailed explanation of the controls that failed would address why customers should expect a different outcome next time.

Bitget's hack just got more expensive, and customers are still waiting for a withdrawal update.

The exchange raised its estimate to $387.5 million in a September 25 update, replacing the earlier $351.6 million figure. It attributed the difference to previously uncounted Zcash and TRON transfers. Bitget said the revision reflects better accounting of the original incident, not another attack. That distinction matters when an already substantial loss grows overnight.

The original alarm came at 18:31 UTC on September 24, according to Bitget's security notice. The company said only part of its hot and warm wallet infrastructure was affected and its cold wallets remained secure. It paused withdrawals while keeping deposits and trading open. Bitget also said account balances remained accurate. Customers therefore face a separation between what their accounts show and their ability to move those assets elsewhere.

The investigation points beyond stolen keys

CEO Gracy Chen has described a compromise of a backend wallet service, according to Cointelegraph. Her account was that attackers forged transfer information and triggered the authorization-signing process. She said the preliminary investigation did not point to leaked private keys. That would put the weakness in the systems instructing transfers, rather than possession of the keys alone. A complete technical explanation is still important before treating that account as the final root-cause finding.

Chen also raised the possibility of North Korean involvement, citing IP and VPN patterns resembling those associated with a North Korean group. That is a preliminary attribution by the exchange's chief executive. It should not be presented as an independently established identity for the attacker. Mandiant and SlowMist are assisting the investigation, Bitget said. For affected customers, identifying the perpetrators and restoring access are separate problems, even when both are being worked on at once.

A coverage promise still needs an operational recovery

Bitget's original notice said its User Protection Fund held more than $464 million and covered the incident. That was the exchange's assurance about its own resources. It does not mean the stolen assets have already been returned. The September 25 update says some funds have been frozen and introduces conditional 5% bounties for eligible freezing or recovery work. Freezing funds and returning them to the exchange are different stages of that process.

Bitget says it has fixed the vulnerability and is validating security before restoring withdrawals. It promises an announcement about withdrawal status or timing by September 26 at 04:00 UTC. That is a deadline for information, not a guaranteed reopening time. The next useful evidence is a clear service update followed by withdrawals actually working again. Until then, the larger loss estimate and the coverage pledge should be read alongside the access restrictions customers still face.