CoinDCX Denies Active Wallet Breach After $16 Million in Suspicious Outflows

Preface

India’s largest crypto exchange, CoinDCX, denied that its active wallets were compromised after blockchain investigators flagged about $16 million in suspicious outflows from addresses associated with the platform. The exchange attributed the activity to old deposit addresses compromised in a July 2025 hack, arguing that those addresses had not been used by CoinDCX since the incident. However, an on-chain investigator disputed that account, saying at least one address continued to receive deposits and interact with the exchange’s current wallet into 2026.

The disagreement centers on a distinction between an active-wallet breach and funds sent to retired deposit addresses. CoinDCX said a temporary failure in its process for moving deposits from deprecated addresses caused operational losses, which it absorbed after crediting affected users. This article explains the reported transactions, the competing claims, how exchange deposit addresses are managed, and what the available information does—and does not—establish.

Lazy bag

CoinDCX says the flagged transactions involved addresses compromised in July 2025, not its active wallets, and maintains that current central and user addresses were unaffected. Blockchain investigator ZachXBT challenged the exchange’s explanation, saying address TQKJQ remained in use and received deposits as recently as April & May 2026. The exchange acknowledged that its deposit-sweeping process temporarily failed for some deprecated addresses. It said affected users were credited, customer assets remained in cold wallets, and trading continued as usual. The central unresolved issue is whether retired addresses continued to function as pathways into CoinDCX’s current wallet after the exchange said they had been abandoned.

Main Body

CoinDCX denied that its active wallets had been compromised after investigators drew attention to about $16 million in outflows from addresses linked to the Indian crypto exchange. The reported activity involved USDT, a dollar-pegged stablecoin, and Tron’s TRX token. The exchange’s response was that the addresses in question were old, had been compromised in July 2025, and were no longer used by the company. It said the transactions did not indicate a breach of its current wallets or customer funds held in active addresses.

In a statement to CoinDesk, a CoinDCX spokesperson said the transactions cited in recent claims involved wallet addresses created in January 2025. According to the exchange, those addresses were compromised in July 2025 and had not been used by CoinDCX since. The spokesperson added that current CoinDCX central and user addresses had not been impacted and that no funds from active wallets had been compromised. This account frames the outflows as activity involving previously compromised addresses rather than a fresh intrusion into the exchange’s current systems.

The concern began when an X user named Darcy highlighted a large outflow from CoinDCX’s hot wallet and several deposit addresses on Wednesday. The combined movement was reported at about $16 million in USDT and TRX. Darcy said the funds were sent to a single Tron address, with the largest transaction amounting to 15,819,002 USDT. That address then distributed the funds across several other wallets. The scale and pattern of the movement led Darcy to flag it as a suspected theft and prompted questions about whether the exchange had experienced another hack.

To understand why a deposit address can remain relevant after an exchange says it has been retired, it helps to understand how deposits are commonly handled. A customer receives a personal deposit address: a unique string of characters used to send cryptocurrency. Exchanges regularly “sweep” deposits from these individual addresses into larger wallets they control. Some funds may be transferred to a hot wallet, which is connected to the internet and used for routine withdrawals. Other assets may be stored in cold wallets, which are kept offline.

CoinDCX said this sweeping process is intended to collect deposits sent to addresses associated with its platform. It also acknowledged a temporary failure in the process for moving deposits from deprecated addresses. The exchange described the resulting losses as operational and said it absorbed them after crediting every affected user. This admission is significant because it distinguishes the reported issue from a confirmed compromise of active wallets: according to the company, some funds were mishandled because the collection process did not work as intended, rather than because an attacker gained control of current wallets.

The exchange had previously been exploited in July 2025 for about $44 million. Following that incident, CoinDCX CEO Sumit Gupta responded on X to the new claims, saying the July 2025 hackers appeared to be reusing old wallet addresses and describing the alarm as false. In the exchange’s explanation, it had abandoned those addresses after the earlier hack, while the people behind that incident continued to use them. That position suggests the fresh movement was not evidence of a new breach, though the question of whether the addresses had remained connected to deposit activity became the focus of subsequent scrutiny.

ZachXBT, a well-known on-chain investigator, challenged CoinDCX’s account. He said at least one address, labeled TQKJQ, was still in use after the July 2025 incident. According to his post, a liquidity provider, or LP, used the address for 10 months after the incident. He also said it swept user deposits and received gas as recently as April & May 2026 to CoinDCX’s current public hot wallet. A liquidity provider is a firm that supplies buy and sell orders to an exchange. Gas is the fee paid to process transactions on a blockchain.

If ZachXBT’s description is accurate, the address’s later activity would complicate the claim that all relevant addresses had been abandoned and were disconnected from current operations. The investigator’s point was not simply that old addresses appeared in transaction records, but that at least one allegedly continued to collect user deposits and pass funds to a current CoinDCX wallet. CoinDCX, for its part, said some users continued to send funds to deprecated deposit addresses despite earlier notifications telling them not to do so. The exchange’s statements and the investigator’s account therefore differ on how the address functioned and what its later transactions demonstrate.

When asked whether the old address had truly been abandoned if it was still handling money, CoinDesk reported that CoinDCX said it had warned users after the July 2025 hack not to deposit to compromised addresses. The exchange now describes those addresses as “deprecated,” meaning retired. Its spokesperson said that, despite past notifications, some users continued depositing to deprecated addresses instead of using the latest ones. CoinDCX further said its sweeping process was intended to catch such deposits but failed for a period. The company said it credited every affected user.

These explanations leave several distinct questions that should not be conflated. First, the reported outflows themselves do not, on the information provided, establish that an attacker accessed CoinDCX’s active wallets. Second, the exchange’s acknowledgment of a temporary operational failure indicates that deposits to deprecated addresses were not handled successfully for a period. Third, ZachXBT’s allegation that TQKJQ received deposits and transferred activity to a current public hot wallet raises a separate question about the relationship between old addresses and current infrastructure. The claims may concern different parts of the deposit process, but the available statements do not fully resolve their apparent conflict.

CoinDCX said customer assets are held in cold wallets, current addresses were not hit, and trading continued as usual. Those are the exchange’s stated position and operational status; they do not independently settle the investigator’s claim about the address’s activity. The reported episode illustrates why clear retirement procedures matter in crypto custody. Exchanges need to communicate address changes, prevent or detect deposits to outdated addresses, and ensure that automated sweeping systems behave as intended. Users, meanwhile, need to verify that they are sending assets to the latest deposit address provided by the platform.

Ultimately, the dispute is about both security and operational controls. CoinDCX denied a new compromise of its active wallets, while acknowledging that its process for handling some deposits to retired addresses temporarily failed. ZachXBT questioned whether at least one address was genuinely inactive, citing activity extending into 2026. The exchange said it credited affected users and that customer assets remained in cold wallets. Based on the statements described, the key distinction is between a confirmed active-wallet breach—which CoinDCX denies—and a reported failure involving deposits to deprecated addresses, which the exchange acknowledged.

Key Insights Table