A Retired Wallet Leaked $16 Million, and the Exchange Is Quietly Eating the Bill

Retiring a wallet isn't the same as securing it. A Mumbai-based crypto exchange is out 15.99 million USDT after someone pulled funds from wallets the company had already taken out of service, the very wallets it retired in the wake of last year's $44 million hack. Combined, the two incidents now sit close to $60 million in losses.

And the exchange is eating it. No user haircut, no socialized losses, no emergency token. Just a balance sheet absorbing another punch.

On paper, that's the responsible move. In practice, it tells you something less flattering about how this industry decommissions infrastructure. Which is to say, it mostly doesn't.

The Second Bite

Start with the numbers, because they're the only thing everyone agrees on. 15.99 million USDT, drained. Roughly $60 million total across both incidents. The first breach cost $44 million and prompted the company to wind down a set of wallets as a precaution. The second breach took money out of those wound-down wallets anyway.

That's the detail that should make every exchange CTO wince. The wallets weren't compromised because they were live and busy. They were compromised because they were old, forgotten, and still real.

Here's the thing about blockchain infrastructure: there's no such thing as a dead address. A wallet doesn't stop existing when a company stops using it. The private keys still work. The smart contract approvals still sit there. Any token allowances users granted years ago are still valid until someone revokes them. "Retired" is a corporate word for a technical condition that doesn't actually exist.

USDT makes this slightly less hopeless than it sounds. It's a centralized asset, issued on rails that can be frozen if Tether cooperates. So recovery isn't impossible. But recovery is a maybe, and a maybe isn't a plan. Anybody who's watched a frozen-funds request drag on for six months knows how this usually goes.

The question worth asking: how many other exchanges are sitting on wallets they believe are dead but aren't? Nobody audits this. Nobody publishes a decommissioning report. The answer is probably uncomfortable and entirely unquantified.

The Case for Shrugging

Now steelman the other side, because there's a real argument here.

Absorbing the loss is expensive, but it's cheaper than the alternative. If a mid-tier exchange passed $16 million of losses onto users, the withdrawal queue would be measured in hours, not days. Trust is the entire product in this business. A company that covers the hole out of its own pocket is signaling that customer funds sit behind a wall, however thin. That signal is worth a lot, and it's worth more than $16 million to a firm that still needs deposits to survive.

There's also a reasonable chance the numbers sound worse than the reality. Wound-down wallets are usually drained of customer assets first. If these addresses held residual balances, treasury funds, or already-written-off positions, then the exchange is covering a bookkeeping loss rather than a solvency event. Proponents of that view would say the market is overreacting to an accounting line.

And to be fair, there's a version of this where absorbing the hit is exactly the kind of boring, unglamorous decision that separates a real business from a casino. Not every firm eats its own losses. Several notable ones have made users whole only after public pressure, court orders, or both.

Color me skeptical, but I'm not entirely convinced by the generosity framing. Covering the loss isn't proof of virtue. It's proof that the brand was worth more than the cash. Those aren't the same thing, and confusing them is how people end up trusting the wrong institutions.

Where I Land

My verdict: the exchange made the right call on payment and the wrong call on infrastructure, and only one of those gets reported.

Absorbing $16 million is correct. It's also the easy part. The hard part is the thing nobody has announced, which is a full audit of every wallet this company has ever touched, every key it still holds, and every contract approval that's still live on-chain. If that audit isn't happening right now, the third bite is already scheduled. It's just not on the calendar yet.

This isn't a Mumbai problem. It's an industry problem dressed up as one company's bad year. Crypto firms spent the last cycle getting very good at incident response and very bad at cleanup. Everyone can spin up an incident blog in an afternoon. Almost nobody wants to spend six months hunting down old addresses and revoking approvals, because that work is boring, unglamorous, and produces no press release. So it slides, quarter after quarter, until a wallet everybody forgot about sends 15.99 million USDT to an address nobody recognizes.

Look, the crypto industry has a track record of learning exactly one lesson per cycle and forgetting it by the next one. The lesson here isn't "hacks happen." Everyone already knows that. The lesson is that old infrastructure is the cheapest attack surface you'll ever leave open, and it stays open because closing it looks like nothing.

So here's my concrete take. If you hold assets on any exchange, ask it a simple question: what's your wallet decommissioning policy? If the answer is vague, that's your answer. And if a company can absorb a $60 million two-part loss and still keep the lights on, good for it. But absorbing a loss and fixing a process are different muscles, and only one of them is visibly flexed.

History suggests otherwise, but I'd love to be wrong. Time will tell, though.