CoinDCX, India's largest crypto exchange, has denied that its active wallets were hacked after reports of about $16 million flowing out. Blockchain analysts tied the funds to addresses linked to the exchange, while the company says they are old addresses compromised back in July 2025.
What analysts spotted
The alarm started on Wednesday. An X user going by Darcy noticed a large outflow from CoinDCX's hot wallet and several of the exchange's deposit addresses. The total came to roughly $16 million in USDT and TRX tokens on the Tron network.
According to Darcy, everything landed on a single Tron address, and the largest transfer was 15,819,002 USDT. From there the money was split across several other wallets. He called it a suspected theft. The exchange was already hacked in July 2025 for about $44 million, so the news quickly stirred fears of a repeat attack.
A quick note on the mechanics. Every user gets a personal deposit address, and the exchange regularly moves these deposits into its own main wallets. Some end up in a hot wallet, which is connected to the internet and handles everyday withdrawals, and the rest goes to cold storage, offline.
CoinDCX's version
An exchange spokesperson told CoinDesk that the transactions in question involve old addresses created in January 2025. They were compromised in July 2025, and the exchange has not used them since. Current central and user addresses, he said, were not affected.
CEO Sumit Gupta called the alarm false on X. In his view, the hackers behind last year's incident are simply still using the old addresses. Trading on the exchange continues as usual.
ZachXBT pushes back
On-chain investigator ZachXBT questioned that account. He argues that at least one of the addresses, labeled TQKJQ, was not abandoned.
"CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet."
ZachXBT, on-chain investigator, from a post on X
Put simply, an address the exchange treats as lost was still collecting customer deposits in the spring and passing them into CoinDCX's current wallet. A liquidity provider is a firm that posts buy and sell orders on an exchange. Gas is the small fee paid to move tokens on a blockchain.
What the exchange admitted
Asked why a supposedly abandoned address was still handling money, CoinDCX said it told clients after the July hack not to deposit to compromised addresses. It now calls them deprecated.
"Despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones," the exchange spokesperson said.
The sweep, the automatic movement of deposits, was meant to catch such transfers but failed for a period. That caused operational losses, which the company absorbed. The exchange says it credited every affected user and that customer assets sit in cold wallets.
What is still unanswered
The two accounts differ on one point. CoinDCX says the addresses were left behind and are run by hackers, while ZachXBT sees a working channel with a liquidity provider until spring 2026. There is no independent confirmation of who owns the wallets that received the $16 million as of publication.
The exchange's own practical advice has not changed: deposit only to the addresses CoinDCX shows now, and do not reuse ones saved earlier.
Comments
Your email address will not be published. Required fields are marked *