CoinDCX Denies a Second Hack After $16M Moves From Wallets Breached in 2025
October 22, 2026
A $16 Million Transfer Puts India’s Biggest Exchange Back Under the Microscope
CoinDCX is facing fresh questions about its wallet security after roughly $16 million moved out of addresses labelled as belonging to the exchange late on Tuesday night. The exchange says there is no new breach. On-chain investigators are not yet convinced. The gap between those two positions is now playing out in public, fifteen months after CoinDCX lost $44 million in its first major hack.What Moved, Where, and When
An on-chain investigator known as Darcy flagged about 15.99 million USDT and 5,783 TRX leaving wallets tagged as CoinDCX deposit addresses and hot wallets at around 23:35 UTC+8 on October 21, according to crypto.news. The largest single transfer was 15,819,002 USDT, sent to one address on the Tron network. From there, the funds split across several wallets, and some reportedly reached deposit addresses at Binance, OKX, and Gate after several intermediary hops. Darcy later claimed that two addresses listed in CoinDCX’s most recent proof of reserves had also sent funds to the flagged Tron address. None of these findings prove the transfers were unauthorised. They do show money leaving wallets that were publicly linked to the exchange.CoinDCX’s Answer: Those Wallets Were Compromised Last Year
CoinDCX responded within hours. In a statement on X, the exchange said the addresses were created in January 2025, were “compromised in July 2025,” and have not been part of its active wallet infrastructure since, as reported by Cointelegraph. Co-founder and CEO Sumit Gupta went further. “CoinDCX wallets are not breached,” he wrote, adding that the exchange had checked its current operational and customer addresses and found no transfers from them to the disputed wallets. In a separate reply, he acknowledged the scrutiny directly: “Yes, aware of that. We’re investigating it further, and will share an update soon.” He also stated, “We assure that no user funds will be at loss.”
ZachXBT Says the Timeline Does Not Add Up
The exchange’s explanation immediately ran into a challenge from blockchain investigator ZachXBT, whose work Digitap covered when he fronted $349,700 to infiltrate a Lazarus laundering ring. ZachXBT pointed to a CoinDCX deposit address that, by his reading of the chain, stayed in use for about ten months after the July 2025 incident by a liquidity provider. He said it received deposits and gas transfers as recently as April and May 2026 and swept user deposits into CoinDCX’s current public hot wallet. His conclusion was blunt: “$15.8M in user deposits was unaccounted for by your team.” If an address the exchange calls dead was still receiving customer money this spring, the question becomes who controlled it, and when.How Deposit Addresses and Hot Wallets Actually Work
A centralised exchange does not hold every customer’s coins in one place. When a user deposits, the exchange hands out a unique deposit address. The exchange periodically “swept” funds landing there into a hot wallet, a larger exchange-controlled wallet connected to the internet so trades and withdrawals can settle quickly. That design is what makes this dispute matter. If an attacker gained control of deposit addresses in July 2025, any customer money sent to those addresses afterward would sit in a wallet the exchange no longer fully controlled. CoinDCX says it stopped using them. ZachXBT’s data suggests at least one kept working for months. Neither side’s screenshots independently prove ownership or intent, and as of Thursday, CoinDCX had not reconciled the transaction history with its statement.The 2025 Hack Still Shapes Everything Here
The context is a $44 million loss in July 2025, when attackers compromised a server and drained an internal liquidity account. CoinDCX said customer assets in cold storage were untouched and that it absorbed the loss from its own treasury, later offering a recovery bounty of up to 25% of recovered funds, capped at $11 million. The exchange had already set up a customer protection fund in August 2024, seeded with about $6 million and topped up with 2% of brokerage income, after rival WazirX lost $230 million to a North Korea-linked attack. Those moves bought CoinDCX credibility. This week’s episode tests whether the clean-up after that hack was as complete as the exchange said.What Users Should Watch For Next
The near-term signals are concrete. CoinDCX has promised a more detailed update through official channels, and investigators will watch whether the exchange publishes wallet-level evidence rather than another statement. If investigators trace the funds to a third party reusing dead addresses, the story may fade quickly. If ZachXBT’s reading holds, CoinDCX could face pressure to explain how a compromised address kept processing deposits, and whether its proof of reserves reflected that. Anyone choosing a crypto exchange in India will be reading those answers closely. The exchange has not announced any suspension of trading, withdrawals, or buy crypto online services, and none of the reports so far cite a confirmed customer loss.Why Trust Is the Real Asset at Stake
CoinDCX may well be right that no customer has lost a rupee. But in crypto, an exchange’s security is judged on what the blockchain shows, not on what the company says. When a public investigator and a public ledger disagree with an official statement, the burden shifts to the exchange to prove its case on-chain. For India’s largest exchange, a second security scare in fifteen months is a reputational problem even if it turns out to be a labelling error. The faster CoinDCX publishes verifiable evidence, the smaller that problem stays.
Share Article
Madiha Riaz
Madiha is a seasoned researcher in cryptocurrency, blockchain, and emerging Web3 technologies. With a background in organic chemistry and a sharp analytical mindset, she brings scientific depth to decentralized innovation. Since discovering crypto in 2017 and investing in 2018, she’s been uncovering and sharing deep insights into how blockchain is redefining the digital asset landscape.
