CoinDCX denies compromise of active wallets after $16 million in suspicious outflows from linked addresses

India’s largest crypto exchange says its current wallets were not touched, even as blockchain analysts flagged about $16 million in outflows from addresses tied to the platform. For high-risk PSPs and exchanges, the useful detail is not the headline theft claim but the wallet-history problem: once old deposit addresses keep interacting with current infrastructure, attribution gets messy fast.

1. CoinDCX said the transactions involved old wallet addresses created in January 2025, which it says were compromised in July 2025 and have not been used by the exchange since. “Current CoinDCX central and user addresses have not been impacted, and no CoinDCX funds from active wallets have been compromised,” a spokesperson told CoinDesk.
2. The alarm started when an X user named Darcy flagged large outflows from CoinDCX’s hot wallet and several deposit addresses on Wednesday. The total was about $16 million in USDT, a dollar-pegged stablecoin, and Tron’s TRX token, with the largest transaction at 15,819,002 USDT. Darcy said the funds were sent to a single Tron address and then split across several wallets.
3. CoinDCX’s model matters here: users get individual deposit addresses, the exchange “sweeps” those deposits into main wallets, and then splits funds between hot wallets, used for day-to-day withdrawals, and cold wallets, kept offline. That’s standard plumbing, but it also means a stale or compromised address can look like a live breach if it is still interacting with current wallet infrastructure.
4. CoinDCX CEO Sumit Gupta said on X that the July 2025 hackers appear to be reusing old wallet addresses and called the report a false alarm. The exchange was previously exploited in July 2025 for about $44 million, so this dispute lands in the middle of an existing incident history rather than in a clean-room environment.
5. On-chain investigator ZachXBT pushed back on CoinDCX’s explanation, saying at least one address, labeled TQKJQ, was still in use. He said the CoinDCX deposit address TQKJQ “was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet.”

CoinDCX also acknowledged a separate operational issue: a temporary failure in its process for moving deposits from retired addresses caused losses, which it said it absorbed after crediting affected users. For PSPs and exchanges, that is the real operational takeaway: old-address handling, wallet retirement, and sweep logic are not back-office trivia; they decide whether an outflow becomes a contained cleanup or a public incident.