10-23-2026 
|
Getting your Trinity Audio player ready...
|
TL;DR: Two crypto compliance setbacks emerged at once. In India, CoinDCX initially dismissed reports of unusual wallet activity before acknowledging a loss of roughly $16 million, traced to a deposit-sweeping process that failed on old, compromised addresses. Meanwhile, in Europe, Ireland’s central bank fined Coinbase’s Irish subsidiary €3.25 million for failing to adequately safeguard customer funds and relying too heavily on its U.S. parent.
Key Takeaways:
- India’s CoinDCX admitted to roughly $16M in ‘operational losses’ after a deposit-sweeping process failed on previously compromised wallet addresses, raising concerns about its handling of the breach and transparency.
- Coinbase’s Irish subsidiary was fined €3.25M by the Central Bank of Ireland for failing to adequately safeguard customer funds and relying too heavily on its U.S. parent for regulatory compliance.
Indian exchange CoinDCX is facing tough questions after initially denying but ultimately admitting its latest security breach, while Coinbase’s (NASDAQ: COIN) Irish offshoot has racked up another multi-million-dollar compliance penalty.
India’s CoinDCX digital asset exchange has admitted suffering a multi-million dollar loss after apparently failing to transfer tokens out of previously compromised digital wallets. In a statement posted to its official X account on Thursday (22), CoinDCX said it had suffered “some operational losses, which were absorbed by CoinDCX,” but stressed that “users’ funds remain completely safe” and the “platform and all trading activities continue to function as usual.”
But CoinDCX’s admission followed earlier denials that anything was amiss. On Wednesday, FlashRescue co-founder Darcy tweeted about unusual transfers from CoinDCX’s “hot wallet and multiple deposit addresses” involving nearly $16 million worth of Tether’s USDT stablecoin, plus nearly 5,800 TRX, the native token of the TRON network. These tokens were then split and sent to different exchanges, including Binance and OKX, as well as to addresses linked to the infamous Huione Group.
CoinDCX initially tweeted a response to Darcy saying “claims circulating on X regarding certain wallet addresses and transactions are misleading.” CoinDCX claimed the transactions involved “old wallet addresses” that were among those compromised in the July 2025 attack by suspected North Korean hackers that cost the exchange $44.2 million. CoinDCX claimed the activity flagged by Darcy “relates to these old addresses and does not have any connection with CoinDCX.”
But blockchain detective ZachXBT quickly called bullshit on these claims, tweeting that the CoinDCX deposit address containing the nearly $16 million in USDT “was in use by a [liquidity partner] for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet. Meaning $15.8M in user deposits was unaccounted for by your team. Why are Indian CEXs so untrustworthy?”
CoinDCX co-founder Sumit Gupta replied that the company was “aware of that. We’re investigating it further and will share an update soon.”
Others questioned why one of the addresses in question had transferred millions of dollars worth of USDT in May to an address listed on CoinDCX’s current official-linked proof-of-reserves page. BeIn Crypto’s research lead wondered “what did these subsequent payments into the reserve-listed destination represent: recovered funds, liquidity-provider settlements, another counterparty arrangement or something else?”
A little later, CoinDCX came (somewhat) clean, admitting that after the 2025 hack “we advised users not to deposit crypto to the compromised wallet addresses.” CoinDCX said these addresses “have since been deprecated” and it “strongly recommended for users not to deposit funds on deprecated addresses, and always verify updated deposit addresses from the CoinDCX App or website.”
CoinDCX then appeared to throw some of its users under the bus, claiming that “despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones. Our operational process is designed for regular sweeping of any such deposits made, so the funds can be properly accounted for and secured. For a particular period, this sweeping process failed, which got identified today morning.”
Some users were quick to point out the shortcomings of CoinDCX’s response, with one noting that (a) it wasn’t the exchange that ‘identified’ this failure, and (b) the company originally claimed these addresses had nothing to do with CoinDCX.
CoinDCX somewhat magnanimously claimed that “all affected crypto deposit wallets for users on CoinDCX were duly credited even though they were made to the deprecated addresses.”
ZachXBT was among those unimpressed with this response, urging users to “withdraw all funds from CoinDCX if you value your assets. Its co-founders are clowns running a circus. They publicly and privately denied a theft of its assets occurred, meaning they straight up lied or are negligently incompetent. Later, they disclosed the $16M theft and wasted everyone’s time instead of being transparent with the public initially.”
When Irish eyes are scowling
The Coinbase exchange took a stake of unspecified size in CoinDCX one year ago, a few months after CoinDCX denied that it was an acquisition target of the U.S.-based company. The investment appeared to be a backup plan in case Coinbase’s latest attempts to operate in India proved as ham-fisted as its previous efforts.
Coinbase has yet to publicly comment on CoinDCX’s PR blunder, but perhaps that’s because it’s busy trying to downplay a costly regulatory fire of its own making.
On Thursday, the Central Bank of Ireland (CBI) imposed a €3.25 million penalty on Coinbase Ireland Ltd (CBIE) for “breaching its safeguarding and outsourcing obligations under the Electronic Money Regulations 2011 (the EMR 2011) between 01 November 2020 and 19 August 2025.”
Specifically, CBIE copped to placing “excessive reliance” on its U.S. parent company “as an outsourced service provider” to implement the controls necessary to comply with Irish/European Union rules. CBIE also failed to have “sufficient local skill and expertise available” to ensure these requirements were being met.
CBIE also failed to “adequately safeguard customers’ funds, both through inadequate system design and insufficient control testing,” resulting in its “designated safeguarding account to be underfunded for lengthy periods of time.”
Coinbase could have faced a 30% larger penalty had it not admitted its shortcomings, but the company issued a blog post that claimed the violations were the result of it “taking steps to protect customers during periods of significant disruption,” including the failures of some crypto-friendly U.S. banks in March 2023.
The official CBI settlement revealed that on March 2, 2023, as California-based Silvergate Bank was failing, CBIE instructed 30 of its institutional users to deposit funds into a Coinbase U.S. account at New York-based Signature Bank. When Signature Bank failed 10 days later, CBIE told these same institutional customers to deposit funds into a Coinbase U.S. account at Cross River Bank.
None of these accounts were held by CBIE, meaning Irish customer funds “were being mixed with the funds of a third party,” aka Coinbase U.S. In other words, Irish customer funds “were not segregated or safeguarded in accordance with CBIE’s regulatory obligations.” It wasn’t until October 2024 that CBIE opened its own account at Customers Bank.
Another issue stemmed from the U.K.’s Brexit vote to leave the European Union in 2020. Coinbase UK migrated over 6.3 million customers to CBIE, but many of these customers failed to update their banking information, meaning they were still depositing into the Coinbase UK segregated safeguarding account.
CBIE alerted CBI to this hiccup in January 2024, but it wasn’t until August 2025 that all CBIE customers were barred from depositing into the Coinbase UK account.
The settlement also cites a “timing mismatch issue” that led to the underfunding of CBIE’s Designated Safeguarding Account. This issue arose from tweaks to a software system called Looker that was responsible for calculating which funds were user funds and which were company capital.
The result was CBIE “consistently underfunding the Designated Safeguarding Account” for a 28-month stretch. As the settlement notes, “had CBIE become insolvent during this time, the Designated Safeguarding Account would not have contained sufficient funds to meet CBIE’s safeguarding obligations.” (Coinbase’s blog blamed this on “inadvertent coding errors” that were “fixed within days” of their discovery.)
In January 2024, CBIE informed the CBI that it had processed euro withdrawal requests from its Designated Safeguarding Account to non-CBIE customers at the request of Coinbase UK and Coinbase U.S. (Coinbase’s blog said this was done “for liquidity reasons.”) This not only meant that CBIE customer funds weren’t properly safeguarded, but the account was being used in violation of CBI rules.
The settlement also details CBIE’s failures to notify CBI of certain ‘material changes,’ including unapproved channels for customers seeking to make USD deposits into CBIE’s European Economic Area account. CBIE also occasionally relied on “significant manual intervention” in its safeguarding arrangements, contradicting the automated systems detailed in CBIE’s application for authorization. (Coinbase claimed it failed to alert the CBI when its safeguarding practices “evolved.”)
Coinbase’s blog stressed that “these issues did not result in any customer losses or limit customer access to funds.” Coinbase further claimed to have “since strengthened our safeguarding processes, added further technical controls, and brought in additional expertise to ensure our regulatory obligations are met.”
The CBI’s director of enforcement Karen O’Leary countered that firms granted permission to work in Ireland “must have the appropriate culture and expertise to comply with the rules, respond to risks and to protect customer interests. While outsourcing presents many benefits to industry, when not effectively managed, it can threaten the operational resilience of firms.”
This is the second fine the CBI has leveled on Coinbase in the past 11 months. The previous penalty was significantly larger (nearly €21.5 million) and resulted from Coinbase “breaching its anti-money laundering (AML) and combatting terrorist financing (CFT) obligations with respect to transaction monitoring … between 23 April 2021 and 19 March 2025.”
Coinbase has also been on the receiving end of a $6.5 million penalty by the U.S. Commodity Futures Trading Commission (CFTC) in 2021 for “reckless false, misleading or inaccurate” transaction reports. In 2023, New York regulators imposed a $100 million settlement on Coinbase for “wide-ranging and long-standing failures” in its AML/KYC procedures. And in 2024, the UK’s Financial Conduct Authority (FCA) fined Coinbase £3.5 million ($4.6 million) for “repeated and material breaches” of financial crime controls.
FAQs
What happened at CoinDCX?
On-chain sleuths flagged nearly $16 million in USDT, plus about 5,800 TRX, moving out of CoinDCX’s hot wallet and deposit addresses and onward to exchanges including Binance and OKX, and to addresses linked to Huione Group.
Why is CoinDCX’s explanation being criticized?
Its story shifted within a day. It first said the addresses were old ones tied to the July 2025 hack and had no connection to the exchange. It later said a sweeping process meant to collect deposits sent to deprecated addresses had failed and was spotted that morning.
Why was Coinbase Ireland fined?
The Central Bank of Ireland found it breached safeguarding and outsourcing rules between November 2020 and August 2025. It relied too much on its U.S. parent, lacked enough local expertise, and underfunded its designated safeguarding account for long stretches.
How does Coinbase respond?
Coinbase says the issues stemmed from steps taken during banking disruptions like the 2023 failures of crypto-friendly U.S. banks, plus coding errors fixed within days, and that no customers lost money or access to funds. It says it has since strengthened controls and added expertise
Watch: Why traditional accounting fails—and how triple-entry solves it
