CoinDCX denies active-wallet hack after about $16 million outflow

CoinDCX denied that active wallets were compromised after blockchain investigators flagged suspicious transfers totaling about $16 million from addresses linked to the exchange. CoinDCX, India's largest cryptocurrency exchange, acknowledged that a temporary failure in moving deposits from retired addresses caused operational losses. CoinDCX absorbed those losses after crediting every affected user.

On Wednesday, an X user named Darcy identified large transfers from a CoinDCX hot wallet and several deposit addresses. The transfers totaled about $16 million in the dollar-pegged stablecoin USDT and Tron's TRX token. Darcy said a single Tron address received all the funds. Darcy identified the biggest transfer as 15,819,002 USDT. The receiving address subsequently distributed the funds among several wallets.

Darcy described the transfers as suspected theft, prompting concerns about another hack at CoinDCX. CoinDCX previously suffered an exploit involving about $44 million in July 2025. CoinDCX CEO Sumit Gupta said the July 2025 hackers appeared to be reusing the old addresses and dismissed the alert as false.

A CoinDCX spokesperson said the addresses involved were created in January 2025 and compromised in July 2025. The spokesperson said CoinDCX had not used those addresses since the compromise and that the newly reported activity had no connection to CoinDCX. The spokesperson said neither current central addresses nor user addresses were affected. The spokesperson also denied that any CoinDCX funds in active wallets had been compromised.

However, on-chain investigator ZachXBT disputed the assertion that the addresses were no longer used. ZachXBT said a liquidity provider used the CoinDCX deposit address labeled TQKJQ for 10 months after the July 2025 incident. ZachXBT said TQKJQ continued forwarding customer deposits to CoinDCX's current public hot wallet as recently as April and May 2026. ZachXBT said the address also received gas during that period. A liquidity provider supplies an exchange with buy and sell orders. Gas is the fee required to transfer tokens on a blockchain.

Each customer receives a distinct deposit address for sending cryptocurrency. The exchange regularly moves those deposits into main wallets under the exchange's control through a process called sweeping. The exchange sends some funds to an internet-connected hot wallet for routine withdrawals. The exchange sends the remaining funds to offline cold wallets.

CoinDCX describes the old deposit addresses as retired. A spokesperson said some users continued sending funds to those addresses despite earlier notifications, rather than using the latest addresses. CoinDCX said sweeping was intended to collect those deposits but temporarily failed. CoinDCX said customer assets are held in cold wallets and reiterated that current addresses were unaffected. Trading continues normally.