CoinDCX Rejects Fresh Hack Claims After $16 Million in Crypto Outflows

CoinDCX, India’s largest cryptocurrency exchange, has denied that its active wallets were compromised after blockchain investigators identified approximately $16 million in suspicious transfers from addresses associated with the platform.

The exchange said the transactions involved older wallet addresses that were compromised during a July 2025 security incident and had since been retired.

“The transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since. The activity now being reported relates to these old addresses and does not have any connection with CoinDCX,” a spokesperson told CoinDesk.

The representative added that the exchange’s current central and user addresses remained unaffected and that no funds held in active CoinDCX wallets had been compromised.

Blockchain Investigator Flags $16 Million Transfer

The controversy began on Wednesday when an X user known as Darcy highlighted substantial outflows involving CoinDCX’s hot wallet and several deposit addresses associated with the exchange.

The transfers reportedly involved around $16 million in USDT, a stablecoin pegged to the U.S. dollar, and TRX, the native token of the Tron blockchain.

Cryptocurrency exchanges typically assign individual deposit addresses to customers so they can transfer digital assets to their accounts. The exchange then periodically consolidates these deposits, a process known as sweeping, by moving funds into wallets under its control.

Some assets are transferred to hot wallets, which remain connected to the internet and facilitate routine withdrawals. Other holdings are stored in cold wallets, which are kept offline to reduce exposure to online threats.

According to Darcy, the funds were transferred to a single Tron address, with the largest transaction totaling 15,819,002 USDT. The receiving address subsequently distributed the assets among several other wallets.

The activity prompted speculation about a potential new security breach, particularly because CoinDCX previously suffered an exploit in July 2025 that resulted in losses of approximately $44 million.

CEO Attributes Activity to Previously Compromised Addresses

CoinDCX CEO Sumit Gupta responded on X, suggesting that the hackers responsible for the July 2025 incident were continuing to use the old wallet addresses. He characterized the renewed concerns as a false alarm.

The exchange’s explanation is that the addresses involved were no longer being used by its operations following the earlier breach, and that the latest transactions were unrelated to its active wallets.

However, blockchain investigator ZachXBT disputed the claim that the addresses had been completely abandoned.

He pointed to an address labeled TQKJQ, arguing that it continued to receive deposits and interact with the exchange after the July 2025 incident.

“CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet,” ZachXBT said.

His statement suggests that the address continued to receive customer deposits and transfer funds into a current CoinDCX hot wallet during April and May 2026.

A liquidity provider, or LP, is a participant that supplies assets or trading liquidity to a market. Gas refers to the fee required to process transactions on a blockchain.

Exchange Says Users Were Warned About Retired Addresses

CoinDCX said it had previously advised customers not to send funds to deposit addresses affected by the July 2025 incident. The exchange now classifies those addresses as deprecated, meaning they have been retired.

“Despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones,” the spokesperson told CoinDesk.

The exchange explained that its sweeping system is designed to identify and consolidate deposits sent to customer addresses. However, it acknowledged that the process failed to operate for a period.

CoinDCX said it subsequently credited all affected users and maintained that customer assets are held in cold wallets. It reiterated that its current addresses had not been compromised and that trading operations continued normally.

The differing accounts leave questions about the historical use of the flagged addresses, but CoinDCX maintains that the reported transactions do not indicate a fresh breach of its active wallet infrastructure.

About The Author

ctleditor

See author's posts