CoinDCX Denies New Security Breach After $16 Million Moves From Old Wallet Addresses
CoinDCX has rejected claims of a fresh hack after blockchain researchers tracked roughly $16 million in cryptocurrency outflows from wallet addresses associated with the Indian exchange. The company maintains that its active wallets remain secure and that the transactions involve addresses compromised in a previous attack.
The exchange’s spokesperson told CoinDesk that the flagged addresses were created in January 2025 and compromised during a July 2025 incident. According to the company, they were no longer in use after that breach.
“The transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since. The activity now being reported relates to these old addresses and does not have any connection with CoinDCX,” the spokesperson said.
The representative added that neither the exchange’s current central wallets nor its active customer deposit addresses had been affected, and no funds in active wallets were compromised.
$16 Million in USDT and TRX Draws Attention
The latest concerns emerged Wednesday after an X user known as Darcy reported substantial transfers involving CoinDCX’s hot wallet and several associated deposit addresses.
The transactions reportedly totaled around $16 million in USDT, a stablecoin pegged to the U.S. dollar, and TRX, the native cryptocurrency of the Tron network.
Crypto exchanges generally provide customers with individual deposit addresses. Incoming funds are periodically consolidated through a process called sweeping, which moves assets into wallets controlled by the exchange.
Exchanges typically keep some funds in hot wallets connected to the internet for routine transactions and withdrawals. Other assets are stored in offline cold wallets to reduce exposure to online attacks.
Darcy said the funds were consolidated into a single Tron address before being distributed among several wallets. The largest reported transfer amounted to 15,819,002 USDT.
The movement of funds raised concerns about another possible CoinDCX breach. The exchange previously suffered a security exploit in July 2025 that resulted in losses of approximately $44 million.
ZachXBT Questions Whether the Addresses Were Abandoned
CoinDCX CEO Sumit Gupta responded to the allegations on X, suggesting that the individuals responsible for the July 2025 hack were reusing the compromised addresses. He described the latest reports as a false alarm.
However, blockchain investigator ZachXBT challenged the assertion that the addresses had been completely abandoned.
He singled out an address labeled TQKJQ, claiming it remained active for a liquidity provider after the earlier incident and continued interacting with the exchange’s current hot wallet.
“CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet,” ZachXBT said.
The allegation suggests that the address continued receiving deposits and forwarding funds to a current CoinDCX wallet as recently as April and May 2026.
A liquidity provider is an entity that supplies assets or trading liquidity to a market. Gas refers to the fee paid to process transactions on a blockchain.
CoinDCX Says Customers Were Warned
CoinDCX told CoinDesk that it had previously instructed users not to send cryptocurrency to deposit addresses affected by the July 2025 breach. The company now describes those addresses as deprecated, meaning they have been retired.
“Despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones,” the spokesperson said.
The exchange explained that its sweeping system is intended to collect funds sent to customer deposit addresses. However, the system reportedly failed to process some deposits for a period.
CoinDCX said it had credited all affected users and emphasized that customer assets remain in cold storage. It reiterated that its current wallets were not compromised and that trading services continued without disruption.
Although CoinDCX denies a new breach, the disagreement over whether the flagged addresses continued to be used after the previous incident has raised questions about the handling of deposits to retired wallets.
