23/10/2026

CoinDCX belatedly admits latest hack; Ireland fines Coinbase anew

By Steven Stradbrooke

Two crypto compliance setbacks emerged at once. In India, CoinDCX initially dismissed reports of unusual wallet activity before acknowledging a loss of roughly $16 million, traced to a deposit-sweeping process that failed on old, compromised addresses. Meanwhile, in Europe, Ireland’s central bank fined Coinbase’s Irish subsidiary €3.25 million for failing to adequately safeguard customer funds and relying too heavily on its U.S. parent.

Indian exchange CoinDCX is facing tough questions after initially denying but ultimately admitting its latest security breach, while Coinbase (NASDAQ: COIN) Irish offshoot has racked up another multi-million-dollar compliance penalty.

India’s CoinDCX digital asset exchange has admitted suffering a multi-million dollar loss after apparently failing to transfer tokens out of previously compromised digital wallets. In a statement posted to its official X account on Thursday (22), CoinDCX said it had suffered “some operational losses, which were absorbed by CoinDCX,” but stressed that “users’ funds remain completely safe” and the “platform and all trading activities continue to function as usual.”

But CoinDCX’s admission followed earlier denials that anything was amiss. On Wednesday, FlashRescue co-founder Darcy tweeted about unusual transfers from CoinDCX’s “hot wallet and multiple deposit addresses” involving nearly $16 million worth of Tether (USDT) stablecoin, plus nearly 5,800 TRX, the native token of the TRON network. These tokens were then split and sent to different exchanges, including Binance and OKX, as well as to addresses linked to the infamous Huione Group.

CoinDCX initially tweeted a response to Darcy saying “claims circulating on X regarding certain wallet addresses and transactions are misleading.” CoinDCX claimed the transactions involved “old wallet addresses” that were among those compromised in the July 2025 attack by suspected North Korean hackers that cost the exchange $44.2 million. CoinDCX claimed the activity flagged by Darcy “relates to these old addresses and does not have any connection with CoinDCX.”

But blockchain detective ZachXBT quickly called bullshit on these claims, tweeting that the CoinDCX deposit address containing the nearly $16 million in USDT “was in use by a [liquidity partner] for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet. Meaning $15.8M in user deposits was unaccounted for by your team. Why are Indian CEXs so untrustworthy?”