EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar23 Oct 2026
India's largest crypto exchange, CoinDCX, says about $16 million in flagged outflows came from deposit addresses compromised in its July 2025 hack, not from its active wallets. On-chain investigator ZachXBT disputes that the addresses were retired, and CoinDCX admits a failure in sweeping deposits from those addresses caused losses it absorbed.
CoinDCX, India’s largest crypto exchange, has denied that its active wallets were hacked after blockchain sleuths flagged about $16 million in suspicious outflows from addresses linked to the exchange, CoinDesk reported on Friday.
What was flagged
An X user named Darcy pointed on Wednesday to a large outflow from CoinDCX’s hot wallet and several of its deposit addresses, totaling about $16 million in USDT and Tron’s TRX token. According to Darcy, all of it went to a single Tron address, with the largest transaction at 15,819,002 USDT, and that address then split the funds across several wallets.
The post raised fears of a fresh breach. CoinDCX was already exploited in July 2025 for about $44 million.
CoinDCX: old addresses, not active wallets
A CoinDCX spokesperson told CoinDesk that the transactions involve wallet addresses created in January 2025 that were compromised in July 2025 and “have not been used by CoinDCX since.” The exchange said its current central and user addresses were not affected and no funds from active wallets were compromised. CEO Sumit Gupta called it a false alarm on X, saying the July 2025 attackers appear to be reusing the old addresses.
The exchange also said that, despite past warnings, some users kept depositing to these now “deprecated” addresses. Its process for sweeping such deposits into its main wallets failed for a period, which caused operational losses. CoinDCX said it credited every affected user, absorbed the losses, keeps customer assets in cold wallets, and that trading continues as usual.
ZachXBT disputes the timeline
On-chain investigator ZachXBT challenged the claim that the addresses were abandoned. He said one deposit address, labeled TQKJQ, was used by a liquidity provider for 10 months after the July 2025 incident and swept user deposits to CoinDCX’s current public hot wallet as recently as April and May 2026.
In plain terms, he says the address kept collecting deposits and passing them into the exchange’s current wallet this spring, which sits awkwardly with the idea that it was fully retired.
What it means for traders
- Always use your current deposit address. Exchanges can rotate deposit addresses after an incident. Copy a fresh address from the deposit page each time instead of reusing an old one saved in a wallet or address book.
- Watch how exchanges explain incidents. CoinDCX says users were made whole, but the gap between its account and ZachXBT’s raises questions about how retired addresses were handled. Clear, verifiable incident reports and proof of reserves are part of how we judge platforms in our testing method.
- Do not keep more on any exchange than you need. Move long-term holdings to self-custody, and when choosing where to trade, compare security records and custody practices in our exchange comparison, including BingX, OKX and Kraken.
Related reviews
Sources
News is for information only and is not financial advice. More crypto news
Get crypto news first on our Telegram channel.
Join on Telegram