CryptoTimes and crypto.news reported that CoinDCX acknowledged a roughly $15.99 million USDT loss involving legacy TRON wallet infrastructure, describing it as an operational loss caused by a failed deposit-sweeping process. The exchange reportedly said active wallets were not breached and affected deposits were credited, although those assurances have not been independently verified. The reports date the incident to October 21, 2026, while the supplied flash lists October 21, 2025.

What CoinDCX says happened in the reported TRON wallet loss

Current secondary reports say CoinDCX acknowledged that around 15.99 million USDT was drained from legacy TRON wallet infrastructure in an incident on October 21, 2026. The exchange reportedly characterized the event as an operational loss, rather than a compromise of active customer wallets. According to the same reports, CoinDCX said customer funds were safe, affected deposits were credited, and normal trading and withdrawals continued.

That only partly answers the main question for readers. Current coverage indicates that the outflow was acknowledged, but the company’s statement was not reviewed directly here. As a result, both the loss details and claims about user safety remain attributed reporting rather than primary confirmation.

The date discrepancy matters because it affects the identity of the event being discussed. Snippets from CryptoTimes and crypto.news point to an outflow on October 21, 2026, followed by an acknowledgment on October 25, whereas the supplied flash identifies October 21, 2025. Without CoinDCX’s original disclosure or reviewed wallet records, the timeline should be treated as attributed rather than settled.

How the reported deposit-sweep failure fits CoinDCX's explanation

According to secondary reports, CoinDCX used a process designed to sweep deposits sent to old addresses into secure wallets. That process reportedly failed for a period, leaving funds exposed in addresses the exchange said were no longer active. This is central to the company’s reported explanation of how funds could be lost without an alleged breach of active, customer-facing wallets.

In practical terms, the incident points to a breakdown in wallet-routing and decommissioning controls. If users or counterparties continued sending funds to old deposit addresses while the automated process meant to transfer those funds onward was not functioning, balances could have remained in locations where they were not intended to stay. That would help explain why CoinDCX reportedly classified the incident as an operational loss.

However, this does not resolve every critical question. Available material does not establish how the attacker obtained access, whether the drained balance consisted entirely of company funds, customer deposits awaiting transfer, or a combination of both, or whether the same technical weakness was involved in the earlier July 2025 incident.

Why the retired-wallet explanation is still disputed

The core dispute is not simply whether a loss occurred. It is whether addresses CoinDCX described as retired were still handling live deposit activity months later.

TradingView, republishing Coinpedia, attributed to ZachXBT the claim that at least one relevant address continued receiving deposits and fee top-ups in April and May 2026. If accurate, the question becomes more specific and more serious: not whether old addresses existed, but whether supposedly retired infrastructure was still operating in practice.

This leaves readers with a clear dividing line. CoinDCX’s reported position is that the loss resulted from legacy-address handling and did not affect active wallets or credited customer balances. The unresolved issue is whether those addresses had truly been decommissioned at all. A wallet list, transaction-backed timeline, or full incident report from CoinDCX would be the next meaningful step toward resolving that gap.