India's largest exchange denies hack after sleuths pointed to $16 million in suspicious outflows
CoinDCX denies its active wallets were hacked after sleuths flagged $16 million in outflows from addresses linked to the India-based exchange.
India's largest crypto exchange, CoinDCX, has denied that its active wallets were compromised, after blockchain sleuths flagged about $16 million in suspicious outflows from wallets linked to the exchange.
“The transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since. The activity now being reported relates to these old addresses and does not have any connection with CoinDCX,” the exchange’s spokesperson told CoinDesk. “Current CoinDCX central and user addresses have not been impacted, and no CoinDCX funds from active wallets have been compromised.”
It started when an X user named Darcy highlighted a large outflow from CoinDCX's hot wallet and several of its deposit addresses on Wednesday. It totaled about $16 million in USDT, a dollar-pegged stablecoin, and Tron’x TRX token.
Every user gets a personal deposit address, a unique string of characters to send crypto to. The exchange then regularly "sweeps" those deposits, meaning it moves them into its own main wallets so everything sits in one place it controls. Some of that money goes to a hot wallet, an internet-connected place used for everyday withdrawals. The rest goes to cold wallets, which are kept offline.
All of it was sent to a single Tron address, Darcy said, with the largest transaction at 15,819,002 USDT. That address then split the money across several different wallets.
Darcy's post flagged the outflow as a suspected theft, raising fears of a fresh hack at the exchange. CoinDCX was exploited before, in July 2025, for about $44 million.
CoinDCX’s CEO Sumit Gupta pushed back on X, saying the July 2025 hackers seem to be reusing the old wallet addresses and calling it a false alarm.
In other words, CoinDCX’s position is that the exchange abandoned those addresses after the hack and that the hackers are the ones still using them.
ZachXBT, a well-known on-chain investigator, challenged that claim. He said at least one of those addresses, labeled TQKJQ was still in use.