CoinDCX Denies Fresh Hack Following $16M Outflow From Retired Addresses

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

The Indian exchange attributed the movements to addresses compromised in July 2025, absorbing operational losses from sweeping errors.

Key points

• CoinDCX denied an active system compromise after analysts flagged approximately $16 million in USDT and TRX outflows.
• The exchange attributed the movements to old deposit addresses previously breached during a $44 million hack in July 2025.
• Investigator ZachXBT reported at least one flagged address continued funneling deposits to CoinDCX's hot wallet through May 2026.

CoinDCX has dismissed claims of an active security breach after on-chain analysts flagged roughly $16 million in suspicious asset transfers from addresses linked to the Indian digital asset trading platform [1]. The exchange maintained that its current central infrastructure and active user wallets remain unaffected, describing the transactions as activity on deprecated addresses compromised during a previous security incident [1].

Blockchain observers initially highlighted the transfers on Oct. 21, tracing approximately $16 million worth of $USDT and Tron's $TRX routed to a single Tron network address [1]. The destination wallet subsequently disbursed the funds across multiple counterparties, with the single largest transaction totaling 15,819,002 USDT [1]. CoinDCX Chief Executive Officer Sumit Gupta categorized the alerts as a false alarm, asserting that the perpetrators of a July 2025 compromise—which resulted in roughly $44 million in losses—were reusing retired infrastructure [1]. At the time of writing, USDT traded at $0.9986, while broader crypto markets recorded a neutral reading on market sentiment.

Analysts Question Infrastructure Deprecation

Independent on-chain investigator ZachXBT disputed the exchange's explanation, providing data indicating that one flagged deposit address remained operational well after the July 2025 breach [1]. According to ZachXBT, a liquidity provider utilized the address across a 10-month span, forwarding aggregated customer deposits and receiving operational network fees directly linked to CoinDCX's primary hot wallet as recently as April and May 2026 [1]. Analysts had earlier placed CoinDCX under scrutiny over $16M transfers originating from historical addresses.

CoinDCX acknowledged that despite historical notices directing customers to update their accounts, certain users continued transmitting funds to outdated destinations [1]. The firm stated that an internal mechanism intended to sweep assets out of legacy addresses temporarily failed, resulting in operational losses [1]. CoinDCX stated it fully credited all impacted depositors and that standard trading services remain uninterrupted [1].

Sources

1. CoinDCX denies hack, blames broken clean up job for $16 million outflow — Primary document (discovered)

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.