CoinDCX is facing fresh scrutiny after on-chain investigators reported suspicious transfers totaling around $16 million on October 21, prompting the exchange's CEO to deny that its current wallets were breached. The claims remain disputed, and the transactions alone do not establish a new hack.
Suspicious Transfers Flagged
On-chain investigator Darcy reported that at 23:35:54 UTC+8, approximately 15.99 million USDT and 5,783.81 TRX were transferred from the exchange's hot wallet and multiple deposit addresses to a single TRON address. The largest transaction involved 15.82 million USDT. According to Darcy, the funds were later split across multiple addresses before reaching deposit addresses linked to Binance, OKX, Gate and other platforms.
CoinDCX previously suffered a $44 million hack in July 2025. The latest suspected theft has not been officially confirmed by the exchange.
CEO Denies Fresh Breach
CoinDCX CEO Sumit denied reports of a fresh $16 million hack, saying the exchange's current wallets have not been breached. He explained that the addresses flagged by Arkham belonged to CoinDCX before the July 2025 hack. According to Sumit, these wallets were created in January 2025 and compromised during last year's incident. He suggested that hackers may be reusing the old addresses.
Sumit said the team checked current exchange and user addresses and found no transfers to the flagged wallets. He added that the investigation is ongoing, with more details expected through CoinDCX's official channels. CoinDCX has said its current wallets remain secure and that no user funds were lost.
New Analysis Challenges Explanation
Fresh on-chain claims have challenged CoinDCX's explanation of the suspected incident. The latest analysis alleges that 15.819 million USDT moved from a CoinDCX deposit address to a single TRON wallet before being split across Binance, OKX, Gate and other destinations. It also claims that addresses listed in CoinDCX's proof of reserves interacted with the receiving wallet.
The analysis describes the transfers as a possible compromised-wallet pattern, contradicting the exchange's claim that the addresses were linked to its July 2025 hack. The allegations remain disputed.
Questions Over User Deposits
On-chain investigator ZachXBT has raised questions about CoinDCX's handling of user deposits following its July 2025 security breach. He claimed that deposit address TQKJQ continued operating for a liquidity provider for 10 months after the incident, with user deposits and gas transfers recorded as recently as April and May 2026. ZachXBT questioned why around $15.8 million in user deposits appeared unaccounted for, raising concerns about transparency at Indian crypto exchanges.
These claims have not been independently verified, and the latest suspected incident has not been officially confirmed by CoinDCX.
