Explore hidden crypto community
External resource highlighted for Gambling Paradise readers.
CoinDCX heist exposes $16 M loss and sparks new Coinbase fine
The CoinDCX heist revealed a $16 M operational loss after a deposit-sweeping failure on legacy wallet addresses. The exchange’s public admission on Oct 22 2026 followed a week of denial. CoinDCX’s co-founder Sumit Gupta confirmed that the loss was absorbed by the company, not the users.
How the deposit-sweeping failure exposed player funds
CoinDCX’s process was designed to move user deposits from hot wallets to a secure vault. Instead, the system routed funds to a public hot wallet that had been compromised in a July 2025 hack. Blockchain forensic analyst ZachXBT traced the missing USDT to a liquidity-partner address that had remained active for ten months after the incident. Gas fees and deposits dated to April and May 2026 appeared in the address, indicating that user funds were swept into a public hot wallet instead of a protected reserve.
The company advised users not to deposit into the deprecated addresses, but some continued to do so. CoinDCX blamed users for the loss, claiming that its sweeping process was meant to catch such deposits. The statement that “users’ funds remain completely safe” lacks evidence; the loss was absorbed by the exchange.
Coinbase’s Irish subsidiary fined for weak fund safeguards
The Central Bank of Ireland announced a €3.25 million fine on Oct 23 2026 for Coinbase’s Irish arm. The regulator cited the subsidiary’s failure to maintain a separate reserve of customer funds and its overreliance on its U.S. parent for regulatory compliance. The fine indicates that the subsidiary did not meet the licensing requirement to keep customer funds segregated.
The penalty underscores the importance of local compliance for crypto-casino operators. A failure to maintain a dedicated reserve can lead to regulatory action that jeopardises player payouts.
Implications for crypto-casino operators
Both incidents highlight how legacy wallet management and inadequate local compliance can threaten player funds. Operators that rely on third-party liquidity partners or defer regulatory duties to a parent company risk regulatory fines and player distrust.
Crypto-casinos that accept USDT or TRX should verify that their deposit-sweeping mechanisms route funds to a secure, audited reserve. They should also maintain a clear separation between customer funds and operational capital, as required by most licensing jurisdictions.
Players should scrutinise operators’ proof-of-reserves disclosures and check whether the addresses listed match the ones used for deposits. A mismatch can signal that user funds are not properly segregated.
What to watch next
Regulators in the EU and India are likely to tighten scrutiny of crypto-casino operators following these incidents. Operators that fail to demonstrate robust fund segregation may face fines or license revocation.
Players should monitor their withdrawal limits and KYC triggers, as operators may impose stricter controls after regulatory pressure. A sudden increase in withdrawal processing time or a higher verification threshold can be a red flag.
Live bitcoin pricing
Related coverage
- Online Gaming License Verification Matrix
- IG Group UK prediction market launch set for 2026
- Colossal Biosciences Accelerates Dodo De-Extinction Timeline