Blockchain investigator “Darcy,” who works for security firm Salus, flagged suspicious movements totaling $16 million on addresses suspected to be associated with crypto exchange CoinDCX on Thursday morning. CoinDCX co-founder Sumit Gupta thanked the researcher but insisted the attribution was “incorrect,” urging Darcy to “don’t spread rumours.”
Several on-chain sleuths have since disputed CoinDCX’s statements, with “SpecterAnalyst” accusing the firm and its co-founder of “lying.”
CoinDCX calls claims “misleading”
In a later update on its official X account, CoinDCX stated that “the transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since.”
CoinDCX suffered a $44 million hack last year after a software engineer’s company laptop was compromised while being used for side work.
Contradicting its initial statement, a second post clarified that users continued to deposit funds into the compromised address despite the exchange’s warning. In response, CoinDCX carried out “regular sweeping… so the funds can be properly accounted for and secured.”
However, “for a particular period, this sweeping process failed,” and apparently only came to light after Darcy’s post flagged the withdrawal of the funds.
CoinDCX eventually recognized the funds as “some operational losses” and insists the deposits were credited to user accounts. It did not detail how the $16 million went unaccounted for over such a long period.
Protos reached out to CoinDCX via email but had not received a response by the time of publication.
Blockchain sleuths have their doubts
Responding to Gupta’s initial denial, Darcy disputed the claim that the wallets were not used by CoinDCX, pointing to gas distribution activities both before and after the July 2025 hack. Darcy also noted that some funds were sent to “addresses associated with [known laundering guarantee services] Huione and Xinbi,” adding “please don’t dodge the issue.”
Former MetaMask security specialist Taylor Monahan pointed out that the laundering techniques differ between today’s transfers and last year’s hack, implying different actors.
Well-known blockchain sleuth ZachXBT claimed that one of the affected addresses was used “by a LP for 10 months” post-compromise and sent funds to “your current public hot wallet” as recently as May 2026.
Other pseudonymous investigators weighed in, with Tanuki42 highlighting the exchange’s contradictory communications and SomaXBT accusing CoinDCX of having moved $70 million of a market maker’s funds via the supposedly deprecated address.
SpecterAnalyst’s post describes the typical signals that indicate outflows of stolen funds. It notes the change in behavior from the affected address, which previously sent funds to CoinDCX’s hot wallet, to suddenly sweeping funds “into a single wallet, which began distributing funds, swapping assets, using OTC services, and more.”
