CoinDCX, India's largest crypto exchange, has denied that its active wallets were compromised after blockchain investigators flagged approximately $16 million in suspicious outflows from addresses linked to the platform.
The activity was first highlighted by an X user named Darcy on Wednesday, who identified large transfers totaling about $16 million in USDT stablecoin and TRX token from CoinDCX's hot wallet and deposit addresses. The largest single transaction involved 15,819,002 USDT sent to a single Tron address, which then distributed the funds across multiple wallets.
CoinDCX's position is that the transactions involved addresses created in January 2025 and compromised during a July 2025 hack. A company spokesperson stated to CoinDesk: "Current CoinDCX central and user addresses have not been impacted, and no CoinDCX funds from active wallets have been compromised."
However, on-chain investigator ZachXBT challenged this account, noting that at least one of the flagged addresses continued to receive deposits and interact with CoinDCX's current wallet into 2026. According to ZachXBT, the address collected customer deposits and passed them into CoinDCX's current public hot wallet as recently as April and May 2026.
CoinDCX acknowledged that despite notifying users following the July 2025 hack not to deposit to compromised addresses, some users continued sending funds to these retired addresses. The exchange said a temporary failure in its deposit-sweeping process—the mechanism used to move funds from user deposit addresses into its main wallets—caused operational losses, which it absorbed by crediting affected users.
The exchange stated that customer assets remain secured in cold wallets and that trading continues normally. CoinDCX experienced a previous exploit in July 2025 that resulted in approximately $44 million in losses.
