CoinDCX, one of India's largest cryptocurrency exchanges, is facing renewed scrutiny following suspicious fund transfers from addresses previously associated with the platform. On-chain investigator Darcy flagged approximately 15.99 million USDT and 5,784 TRX transferred from these addresses to a single TRON wallet on October 21, 2026.
The largest single transaction involved 15.82 million USDT, which was subsequently split and routed to deposit addresses connected to major exchanges including Binance, OKX, and Gate.
CoinDCX Denies Active Wallet Breach
CoinDCX co-founder Sumit Gupta disputed claims that the exchange's active wallets had been compromised. Gupta stated that the transactions involved addresses reused by hackers from a previous incident, rather than a current breach. He asserted that none of CoinDCX's present central or user addresses had sent funds to the flagged addresses.
Gupta explained that the affected addresses, including the TQKJQ wallet, had been marked as deprecated following a July 2025 exploit. The exchange stated it absorbed operational losses from that prior incident and credited affected users, while emphasizing that customer assets remain protected in segregated cold storage.
On-Chain Evidence Contradicts Exchange Claims
Blockchain investigator ZachXBT challenged CoinDCX's explanation with on-chain evidence. According to ZachXBT, the flagged address remained active with a liquidity provider, processed user deposits regularly, and interacted with a current CoinDCX hot wallet as recently as April and May 2026. This finding raised questions about whether the addresses should be considered inactive and whether the approximately $15.8 million in assets had actually gone missing.
Prior Security Issues
This incident marks the second major security event for CoinDCX. In July 2025, the exchange suffered a $44 million hack. The current scrutiny comes as Indian crypto exchanges face heightened attention, with SunCrypto, another Indian exchange, also reporting server-side technical issues that temporarily disabled its app, though the exchange stated user funds remained secure.
