CoinDCX, India's largest crypto exchange, denied that its active wallets were hacked after blockchain sleuths flagged about $16 million in suspicious outflows. The exchange says the funds moved through old addresses compromised in July 2025, but an on-chain investigator says at least one of them was still in use in 2026.
CoinDCX denied that its active wallets were compromised after blockchain sleuths flagged about $16 million in suspicious outflows from wallets linked to the exchange. The platform is India's largest crypto exchange.
What the sleuths flagged
An X user named Darcy highlighted a large outflow from CoinDCX's hot wallet and several of its deposit addresses on Wednesday. The outflow totaled about $16 million in USDT, a dollar-pegged stablecoin, and Tron's TRX token.
Darcy said everything went to a single Tron address, and the largest transaction was 15,819,002 USDT. That address then split the money across several wallets. Darcy's post flagged the outflow as a suspected theft, which raised fears of a fresh hack. The exchange was exploited before, in July 2025, for about $44 million.
CoinDCX says the addresses were retired
A CoinDCX spokesperson told CoinDesk that the transactions involve old wallet addresses created in January 2025, compromised in July 2025 and unused by the exchange since. According to the spokesperson: "Current CoinDCX central and user addresses have not been impacted". CEO Sumit Gupta also called it a false alarm and said the July 2025 hackers seem to be reusing the old addresses.
An investigator disputes the claim
ZachXBT, an on-chain investigator, challenged that claim. He said at least one address, labeled TQKJQ, was in use by a liquidity provider for 10 months after the July 2025 incident. He added that it swept user deposits and received gas as recently as April and May 2026 to CoinDCX's current public hot wallet.
The spokesperson responded that CoinDCX told users not to deposit to compromised addresses after the 2025 hack, but some kept doing so. The exchange said its sweeping process, meant to catch such deposits, failed for a period. It said it credited every affected user, that customer assets sit in cold wallets, and that trading continues as usual.
Source: CoinDesk
Trading involves risk.
Risk Disclaimer
