CoinDCX Rejects Hack Allegations as Investigators Track $16 Million in Crypto Transfers

CoinDCX has denied suffering another security breach after blockchain analysts identified approximately $16 million in cryptocurrency transfers involving wallet addresses linked to the Indian exchange. The company says the activity originated from previously compromised addresses rather than its current wallet infrastructure.

A CoinDCX spokesperson told CoinDesk that the addresses were created in January 2025 and compromised during a cyberattack in July that year. The exchange maintains that it stopped using them after the incident.

“The transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since. The activity now being reported relates to these old addresses and does not have any connection with CoinDCX,” the spokesperson said.

The company also stated that its current central wallets and active customer deposit addresses had not been affected, adding that no funds in its active wallets were compromised.

Suspicious Transfers Involve USDT and TRX

The latest allegations surfaced Wednesday when an X user identified as Darcy highlighted large outflows involving CoinDCX’s hot wallet and several related deposit addresses.

The reported transactions involved approximately $16 million in USDT, a dollar-pegged stablecoin, and TRX, the native token of the Tron blockchain.

Cryptocurrency exchanges commonly assign unique deposit addresses to customers. Incoming funds are then consolidated through a process known as sweeping, which transfers assets into wallets controlled by the exchange.

Hot wallets remain connected to the internet and are used for routine transactions, including customer withdrawals. Cold wallets, by contrast, are stored offline to help protect assets from online attacks.

Darcy said the funds were first transferred to a single Tron address before being dispersed across multiple wallets. The largest transaction reportedly involved 15,819,002 USDT.

The transfers triggered speculation about another potential breach at CoinDCX, which suffered an exploit in July 2025 that resulted in approximately $44 million in losses.

ZachXBT Challenges Exchange’s Explanation

CEO Sumit Gupta addressed the reports on X, suggesting that the attackers behind the July 2025 incident were continuing to use the old compromised addresses. He dismissed the latest concerns as a false alarm.

Blockchain investigator ZachXBT disputed the claim that the addresses had been entirely retired, pointing specifically to an address identified as TQKJQ.

“CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet,” ZachXBT said.

His comments suggest that the address continued to receive deposits associated with a liquidity provider and transferred funds to a current CoinDCX hot wallet after the earlier incident.

Liquidity providers supply assets or trading liquidity to markets, while gas is the fee required to execute blockchain transactions.

Exchange Cites Warnings to Customers

CoinDCX said it had previously notified users that they should avoid sending funds to deposit addresses affected by the July 2025 breach. The company now classifies those addresses as deprecated, indicating they are no longer intended for use.

“Despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones,” the spokesperson told CoinDesk.

The exchange said its automated sweeping process is designed to consolidate customer deposits but acknowledged that the system failed to function for a period.

CoinDCX added that it had credited all affected users and that customer assets were held in cold wallets. It reiterated that its current addresses remained secure and that trading operations were continuing normally.

While the exchange maintains that no new breach occurred, the conflicting statements have drawn attention to whether certain legacy deposit addresses continued to receive or process funds following the 2025 attack.