CoinDCX Says Active Wallets Are Safe After $16 Million in Suspicious Crypto Transfers

CoinDCX has denied allegations of a new hack after blockchain investigators identified approximately $16 million in transfers involving cryptocurrency addresses associated with the Indian exchange. The company attributes the activity to legacy wallets compromised in a July 2025 attack, insisting that its current wallet infrastructure remains unaffected.

A CoinDCX spokesperson told CoinDesk that the addresses involved were created in January 2025 and compromised several months later. The exchange said it discontinued their use after the incident and that the newly reported transactions were unrelated to its active operations.

“The transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since. The activity now being reported relates to these old addresses and does not have any connection with CoinDCX,” the spokesperson said.

The company added that its current central and customer deposit addresses had not been compromised and that no funds in active wallets were affected.

$16 Million in Transfers Triggers Security Concerns

The reports emerged Wednesday after an X user known as Darcy highlighted large outflows from CoinDCX’s hot wallet and several related deposit addresses.

The transfers reportedly involved approximately $16 million in USDT, a stablecoin pegged to the U.S. dollar, and TRX, the native token of the Tron blockchain.

Cryptocurrency exchanges generally provide customers with unique deposit addresses. They periodically consolidate incoming funds through a process called sweeping, which transfers assets into wallets controlled by the exchange.

Hot wallets remain connected to the internet to support routine transactions and withdrawals, while cold wallets are stored offline to reduce exposure to cyberattacks.

According to Darcy, the funds were transferred to a single Tron address before being distributed across several other wallets. The largest reported transaction totaled 15,819,002 USDT.

The activity prompted speculation about another potential security incident at CoinDCX, which suffered a separate exploit in July 2025 that reportedly cost approximately $44 million.

Blockchain Investigator Challenges CoinDCX’s Account

CEO Sumit Gupta responded to the allegations on X, suggesting that the individuals behind the July 2025 attack were continuing to use the old compromised addresses. He characterized the latest reports as a false alarm.

However, blockchain investigator ZachXBT disputed the suggestion that the addresses had been completely abandoned. He highlighted an address identified as TQKJQ, claiming it continued to be used after the previous incident.

“CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet,” ZachXBT said.

His statement suggests that the address continued receiving deposits associated with a liquidity provider and forwarding funds to a current CoinDCX hot wallet in April and May 2026.

Liquidity providers supply assets or trading liquidity to markets. Gas refers to the transaction fee paid to process activity on a blockchain.

Exchange Points to Deposits Sent to Deprecated Addresses

CoinDCX said it had previously warned users against sending cryptocurrency to deposit addresses affected by the July 2025 incident. Those addresses are now classified as deprecated, meaning they have been retired.

“Despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones,” the spokesperson told CoinDesk.

The exchange said its sweeping system is designed to consolidate customer deposits but acknowledged that the process failed for a period. It added that all affected users had been credited.

CoinDCX reiterated that customer assets are stored in cold wallets, its current addresses remain secure and trading services continue normally.

The exchange’s denial has not resolved the disagreement over whether certain legacy addresses continued to process deposits after the earlier attack. The reported transfers have renewed scrutiny of how the platform handles deposits sent to retired wallet addresses.