- Leading cryptocurrency exchange CoinDCX has rejected claims of a fresh $16 million crypto hack, clarifying that the flagged wallets were breached in July 2025 and have not been operated by the platform since.
- On October 21, blockchain analysts tracked approximately 15.99 million USDT and 5,783.81 TRX in transfers.
- Prominent on-chain investigator ZachXBT disputed CoinDCX’s account, asserting that a previously compromised address stayed active for several months following the original breach.
Major Indian cryptocurrency exchange CoinDCX has pushed back against accusations of a new security incident after blockchain sleuths spotted roughly $16 million worth of USDT and TRX moving from wallet addresses historically associated with the exchange.
The October 21 transactions have reignited scrutiny regarding CoinDCX’s security breach from July 2025 and the current status of those impacted wallets. In a public statement posted to X, CoinDCX insisted that “users’ funds are safe” and labeled the claims concerning the wallet addresses and transfers as “misleading.”
The cryptocurrency platform clarified that the addresses were initially generated in January 2025 and compromised during the security event in July 2025. CoinDCX stated firmly that these wallets have not been utilized by the company since that time.
“The activity now being reported relates to these old addresses and does not have any connection with CoinDCX,” the firm stated, adding that regular trading and investment activities continue as normal.
Users’ funds are safe.
Claims circulating on X regarding certain wallet addresses and transactions are misleading.
The transactions mentioned in recent claims involve old wallet addresses created in January 2025.
These addresses were compromised in July 2025 and have not been used by CoinDCX since.
The activity now being reported relates to these old addresses and does not have any connection with CoinDCX.
Trading & investing continue as usual.
For updates, trust only official CoinDCX channels.
For any queries, reach out to @CoinDCX_Cares— CoinDCX (@CoinDCX) October 22, 2026
Sumit Gupta, co-founder of CoinDCX, also dismissed the allegations, explaining that the Arkham-flagged addresses once belonged to the exchange but were compromised during the 2025 incident. He proposed that hackers might be recycling those exact addresses to trigger a false alarm.
Gupta noted that the exchange audited its active company and user wallets and discovered zero transfers directed to the old addresses. He reiterated that no CoinDCX assets have been compromised and stated that the internal investigation is ongoing.
Old Wallet Activity Raises Questions
The pushback comes in response to findings from Darcy, a blockchain security investigator tied to Salus, who highlighted movements of roughly 15.99 million USDT and 5,783.81 TRX around 23:35 UTC on October 21. These monitored transactions stirred worries about potentially illicit movements tied to CoinDCX-associated wallets.
10 月 21 日 23:35:54（UTC+8），CoinDCX 疑似被盗取约1,599 万 USDT 和 5,783.81 TRX
CoinDCX 热钱包及多个充值地址，向 TRON 地址 TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT 转入约 1,599 万 USDT 和 5,783.81 TRX
其中最大单笔为 15,819,002 USDT，该地址随后向多个地址转出资金，经多次拆分流向Binance、OKX、Gate 等充值地址— Darcy 资产救援
(@DarcyAri) October 22, 2026
Shortly after, blockchain researcher ZachXBT cast doubt on CoinDCX’s account of its previous security breach. He claimed that an address labeled TQKJQ kept receiving deposits for approximately 10 months following the July 2025 event, with transaction records appearing as late as April and May 2026.
ZachXBT further alleged that this particular address maintained links to current public hot wallets operated by CoinDCX. He contended that such activity directly challenges the firm’s assertion that the compromised addresses were abandoned.
Even so, the observed blockchain data does not conclusively prove that CoinDCX experienced a fresh security breach or that customer funds are missing. The exchange maintains that the addresses in question are legacy accounts and that the recent transfers have zero bearing on its current operations.
This controversy stems from an earlier CoinDCX security incident on July 19, 2025, when an internal operational account designated for liquidity provisioning on a partner exchange was breached. In its formal post-incident review, CoinDCX assured users that customer wallets remained untouched and that the company absorbed the financial deficit using its own treasury reserves.
The debate now focuses on whether the wallet data tracked by independent researchers contradicts CoinDCX’s timeline. While the cryptocurrency exchange maintains that user funds are secure, the conflicting claims remain unverified by independent sources, and current evidence does not validate any new breach at CoinDCX.
Frequently Asked Questions
Did CoinDCX suffer a new $16 million security breach?
No. CoinDCX has strongly denied allegations of a new hack, stating that the flagged transactions involve legacy wallet addresses that were compromised during an incident in July 2025 and have not been used by the exchange since.
What transactions triggered the recent allegations?
Blockchain investigators flagged transfers of roughly 15.99 million USDT and 5,783.81 TRX originating from wallet addresses historically linked to the cryptocurrency platform.
Are user funds secure on CoinDCX?
Yes. CoinDCX leadership and official statements have confirmed that user funds and company assets remain secure, and that trading and investing on the platform are continuing as usual.
What was the July 2025 security incident?
The July 19, 2025 incident involved the compromise of an internal operational account used for liquidity provisioning on a partner exchange. CoinDCX previously reported that customer wallets were unaffected and that the financial exposure was covered by corporate treasury reserves.
