CoinDCX Denies Fresh Hack After $16 Million in Transfers From Legacy Wallets

CoinDCX has dismissed reports of a new security breach after blockchain investigators flagged approximately $16 million in cryptocurrency movements involving wallet addresses connected to the Indian exchange. The company says the transactions involve previously compromised addresses and do not indicate that its current wallets have been hacked.

A spokesperson told CoinDesk that the addresses were established in January 2025 and compromised in an attack in July of that year. According to the exchange, those addresses were retired following the incident and are no longer used in its operations.

“The transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since. The activity now being reported relates to these old addresses and does not have any connection with CoinDCX,” the spokesperson said.

The company added that its current central wallets and active customer deposit addresses were unaffected, with no funds held in active wallets compromised.

Blockchain Sleuth Flags $16 Million in Outflows

The issue came to light Wednesday when an X user operating under the name Darcy identified significant outflows involving CoinDCX’s hot wallet and several associated deposit addresses.

The transactions reportedly included around $16 million in USDT, a stablecoin designed to track the U.S. dollar, and TRX, the native cryptocurrency of the Tron network.

Crypto exchanges typically provide customers with individual addresses for deposits. These funds are often consolidated through a process known as sweeping, which moves assets into wallets controlled by the exchange.

Hot wallets are connected to the internet and facilitate regular transactions, including withdrawals. Cold wallets are kept offline to provide additional protection against online attacks.

Darcy said the funds were moved to a single Tron address before being distributed across multiple wallets. The largest reported transfer was 15,819,002 USDT.

The activity raised concerns about a possible new attack on CoinDCX, which previously lost approximately $44 million in an exploit in July 2025.

ZachXBT Disputes Claim That Old Addresses Were Retired

CoinDCX CEO Sumit Gupta responded on X, suggesting that the attackers from the July 2025 incident were reusing the compromised addresses. He described the latest reports as a false alarm.

However, prominent blockchain investigator ZachXBT questioned whether the addresses had truly stopped being used. He pointed to an address labeled TQKJQ and claimed it continued to receive deposits and interact with the exchange’s current hot wallet after the earlier hack.

“CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet,” ZachXBT said.

The claim indicates that the address may have continued processing deposits linked to a liquidity provider and sending funds to a current CoinDCX wallet as recently as April and May 2026.

A liquidity provider supplies assets or trading liquidity to a market. Gas is the fee required to process transactions on a blockchain.

CoinDCX Says Some Customers Continued Using Old Addresses

CoinDCX said it had warned customers after the July 2025 incident not to send funds to the affected deposit addresses. The company now labels them as deprecated, meaning they have been retired.

“Despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones,” the spokesperson said.

The exchange explained that its sweeping system is designed to collect funds deposited into customer addresses, but acknowledged that the process failed for a period. It said all affected customers had been credited.

CoinDCX also reiterated that customer assets are held in cold wallets, its current addresses remain unaffected and trading continues as usual.

Although the exchange denies a fresh compromise, the disagreement over whether legacy addresses continued to handle deposits after the previous attack has raised questions about its management of retired wallets.