CoinDCX Denies Fresh $16 Million Hack as Investigators…

CoinDCX has pushed back against claims that it suffered a second major security incident, after blockchain investigators flagged approximately $16 million in suspicious transfers originating from addresses linked to the Indian cryptocurrency exchange. The disputed movements took place on October 21 and involved about 15.99 million Tether (USDT) alongside 5,783.81 TRON (TRX) tokens.

The transfers were first highlighted by blockchain investigator Darcy, who traced assets from wallets identified as belonging to CoinDCX to a receiving address on the TRON network. The funds were then spread across multiple addresses, with portions reportedly landing at accounts associated with Binance, OKX and Gate. The single largest movement was roughly 15.82 million USDT from one address.

Conflicting accounts of wallet activity

Blockchain intelligence firm Bitquery followed up on October 22 with an examination of activity across 40 TRON wallets tied to the exchange. It reported that about $15.99 million had moved through the addresses, that some wallets kept processing transactions after the July 2025 breach, and that 276 fee top-ups linked to deposit-processing activity had occurred since August 2026. One wallet was active roughly five minutes before the suspicious transfers began, according to the analysis. Bitquery estimated that about $9.63 million reached deposit addresses at major exchanges within 18 hours, while $2.28 million remained in seven addresses tied to the suspected recipient at the time of its assessment.

CoinDCX co-founder and chief executive Sumit Gupta said the flagged addresses were compromised in the July 2025 incident and were no longer used operationally. The exchange said the wallets were created in January 2025 and that customer funds remain secure, with trading and investment services running normally. Investigator ZachXBT challenged that position, citing transaction activity involving addresses allegedly tied to customer deposits after the earlier breach.

In July 2025, CoinDCX confirmed attackers had compromised an internal operational account used for liquidity provisioning on a partner exchange. The company put its exposure at about $44 million and said the loss would be absorbed by corporate treasury reserves, with customer assets in segregated cold wallets unaffected.

The latest allegations have renewed scrutiny of the exchange's wallet management, transaction monitoring and incident-response procedures. Even so, the October transfers cannot yet be treated as a confirmed second theft, and adding them to the 2025 loss to arrive at a cumulative figure of roughly $60 million would require evidence of a separate unauthorized loss. Ownership of the assets, the operational status of the addresses and any outstanding customer liabilities all remain unresolved pending a detailed reconciliation from CoinDCX or independent verification.