CoinDCX Denies $16 Million Hack, Tracing Flagged Wallets to Its 2025 Breach

CoinDCX co-founder Sumit Gupta initially denied a fresh breach at the Indian crypto exchange. A security researcher had flagged $15.99 million in Tether (USDT) moving out of wallets tagged to the platform.

Gupta said the addresses belonged to CoinDCX before its July 2025 hack and were compromised in that attack. However, on-chain investigator ZachXBT later said one of those deposit addresses was still sweeping user funds to CoinDCX's current hot wallet as recently as May 2026. Gupta acknowledged the point and said no user funds would be lost.

A $15.8 Million Transfer Sets Off the Alarm

Darcy, chief marketing officer at security firm Salus, raised the alert on X on October 22.

According to the post, CoinDCX's reported hot wallet and several deposit addresses sent funds to a single TRON address late on October 21 (UTC+8). The outflow totaled roughly 15.99 million USDT and 5,783.81 TRON (TRX).

The largest single transfer moved 15.82 million USDT. The receiving address then split the money across multiple wallets.

After several rounds of splitting, the funds reached deposit addresses on Binance, OKX, Gate, and other exchanges, Darcy said.

However, CoinDCX's leadership disputed that any of those wallets still belonged to the exchange.

CoinDCX Traces the Flagged Wallets to Last Year's Breach

Gupta replied to Darcy's post less than three hours after it went live.

"Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don't spread rumours," he said.

"Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don't spread rumours," he said.

He explained that Arkham had tagged the addresses to CoinDCX. However, the exchange generated them in January 2025, and they were compromised during the July 2025 attack.

In Gupta's view, the hackers appear to be reusing those old addresses. He added that the team checked every current central and user address on the exchange.

None of them had sent funds to the flagged addresses, he said. Gupta also noted that all CoinDCX addresses are public on its proof-of-reserves (PoR) page.

The earlier breach cost CoinDCX $44.2 million in July 2025. At the time, Gupta said attackers hit an internal wallet used for liquidity on a partner exchange, and customer funds stayed safe.

ZachXBT Challenges the 'Old Wallet' Explanation

On-chain investigator ZachXBT disputed Gupta's account in a post on X.

He said a CoinDCX deposit address beginning with "TQKJQ" was used by a liquidity provider (LP) for 10 months after the July 2025 incident. According to ZachXBT, the address swept user deposits to CoinDCX's current public hot wallet and received gas fees as recently as April and May 2026.

"Meaning $15.8M in user deposits was unaccounted for by your team," he wrote.

"Meaning $15.8M in user deposits was unaccounted for by your team," he wrote.

ZachXBT also questioned the track record of Indian exchanges, naming WazirX and BitBNS alongside CoinDCX. WazirX lost over $230 million in a July 2024 hack.

Gupta replied directly to the post.

"Yes, aware of that. we're investigating it further, and will an update soon. We assure that no user funds will be at loss," he said.

"Yes, aware of that. we're investigating it further, and will an update soon. We assure that no user funds will be at loss," he said.

Earlier, Gupta had said the flagged addresses no longer belonged to CoinDCX. This marks a shift from that position.

Darcy Points to Wallets on CoinDCX's Own Reserve List

Darcy then raised the stakes.

"If @CoinDCX was not hacked, then it appears to have stolen its users' assets itself," the Salus CMO wrote.

"If @CoinDCX was not hacked, then it appears to have stolen its users' assets itself," the Salus CMO wrote.

According to Darcy, two addresses listed in CoinDCX's latest PoR report sent funds to the address identified as the hacker's (TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT). The two addresses are:

TFLxNHunhEizmeEdiMyA3r2XGLSKaEznGd

TFLxNHunhEizmeEdiMyA3r2XGLSKaEznGd

TM5r1bNJ2TjZwfS757tPPtr84MwtEjL9qN

TM5r1bNJ2TjZwfS757tPPtr84MwtEjL9qN

Darcy added that the hot wallet, TFLxN…, kept distributing 15 TRX for gas both before and after what CoinDCX describes as the hack.

"Are you suggesting that the hackers were handling gas funding distribution for you?" Darcy asked.

"Are you suggesting that the hackers were handling gas funding distribution for you?" Darcy asked.

Darcy's tracking shows these amounts reaching exchanges:

OKX: 5.47 million USDT, plus a separate 50,000 USDT

OKX: 5.47 million USDT, plus a separate 50,000 USDT

Binance: 2.02 million USDT

Binance: 2.02 million USDT

Gate: 1.39 million USDT

Gate: 1.39 million USDT

Some funds also went to addresses linked to Huione and Xinbi. Blockchain analytics firm Elliptic has tied these Telegram-based marketplaces to large-scale money laundering.

CoinDCX had not publicly addressed Darcy's latest claims at the time of writing. Gupta said the exchange's official accounts will more details soon.

Read the Original story CoinDCX Denies $16 Million Hack, Tracing Flagged Wallets to Its 2025 Breach by Kamina Bashir at beincrypto.com