Blockchain investigators detected roughly $16 million flowing out of addresses tied to Indian cryptocurrency exchange CoinDCX, but the exchange denies that its active wallets were hacked.
India's largest crypto exchange, CoinDCX, has denied that its active wallets were compromised after blockchain investigators spotted suspicious outflows of about $16 million from wallets linked to the exchange.
A CoinDCX spokesperson stated: "The transactions referenced in recent allegations involve old wallet addresses created in January 2025. Those addresses were compromised in July 2025, and CoinDCX has not used them since. The transaction activity being reported now relates to those old addresses and has nothing to do with CoinDCX."
The spokesperson added: "The core wallet addresses and user addresses currently used by CoinDCX are unaffected, and no CoinDCX funds in active wallets have been compromised."
The matter began on Wednesday when an X user named Darcy pointed out that CoinDCX's hot wallet and several deposit addresses had seen large outflows, involving roughly $16 million in USDT and Tron's TRX token. USDT is a stablecoin pegged to the US dollar.
Every exchange user is given a dedicated deposit address — a unique string of characters used to receive cryptocurrency. Exchanges typically "sweep" funds from these deposit addresses on a regular basis, moving them into main wallets controlled by the exchange for centralized management. Some of those funds go into hot wallets, which are connected to the internet and used to process daily withdrawals; the rest are moved into cold wallets that stay offline.
Darcy said all the funds were sent to a single Tron blockchain address, with the largest single transaction involving 15,819,002 USDT. That address then dispersed the funds across multiple different wallets. In the post, Darcy flagged the outflow as a suspected theft, sparking market concerns that CoinDCX might have been hacked again.
CoinDCX had previously been hacked in July 2025, losing about $44 million. CoinDCX CEO Sumit Gupta subsequently pushed back on the allegations on X, saying the hackers behind the July 2025 attack appeared to be reusing old wallet addresses and that this incident was a false alarm. In other words, CoinDCX's position is that the exchange abandoned those addresses after the earlier hack, and it is the hackers who are still using them.
However, well-known on-chain investigator ZachXBT disputed this. He said at least one wallet address labeled TQKJQ is still in use. ZachXBT said: "After your July 2025 security incident, CoinDCX's deposit address TQKJQ was still used by a liquidity provider for 10 months. As late as April and May 2026, that address was still sweeping user deposits and receiving gas to pay on-chain transaction fees, and the funds flowed to the hot wallet you currently publicly use."
Simply put, ZachXBT believes this address was still receiving customer deposits through the spring of this year and transferring funds into wallets CoinDCX currently uses. A liquidity provider (LP) is an institution that supplies buy and sell orders to an exchange, providing liquidity to the market. Gas refers to the small transaction fee required to move tokens on a blockchain.
The exchange said that after the July 2025 hack, it notified users to stop depositing funds into the compromised addresses. CoinDCX now refers to these addresses as "deprecated."
The exchange spokesperson said: "Despite our past notices, some users continued to deposit funds into deprecated deposit addresses instead of using the latest deposit addresses."
CoinDCX said the fund sweeping mechanism was originally designed to handle such mistaken deposits, but that the mechanism failed for a period of time. The exchange said it has topped up the corresponding funds for all affected users. CoinDCX stressed that customer assets are held in cold wallets, the addresses currently used by the exchange were not affected by this incident, and the platform's trading operations remain normal.
Comments