CoinDCX denies new hack after about $16 million in flagged transfers

CoinDCX, a cryptocurrency exchange in India, denied a fresh security breach after analysts identified suspicious transfers. Darcy, co-founder of the asset recovery platform FlashRescue, flagged about $16 million in transfers on Thursday from addresses labeled as belonging to CoinDCX. CoinDCX said on Thursday that the flagged transactions involved older wallets established in January 2025. CoinDCX said those wallets were compromised in July 2025 and that the exchange had not used the wallets since that incident.

Blockchain investigator ZachXBT disputed the exchange's account, saying a liquidity provider continued using a CoinDCX deposit address for 10 months after the July 2025 incident. ZachXBT said the address kept sending user deposits to CoinDCX's current public hot wallet and receiving funds for transaction fees. Darcy also claimed that two addresses in CoinDCX's latest proof of reserves had sent funds to the flagged Tron address.

CoinDCX CEO Sumit Gupta acknowledged the issue and said the exchange was investigating further. Gupta promised an update soon and assured users that no user funds would be lost. CoinDCX did not answer a request for comment before publication.

CoinDCX lost $44 million in the July 2025 hack. CoinDCX said at the time that customer wallets were separate from the affected account. CoinDCX also said the exchange would use treasury reserves to cover the loss.