USD
CoinDCX Denial Faces Fresh Scrutiny Over $16M Wallet Movements
Post-Breach Wallet Activity Challenges Exchange’s “False Alarm” Explanation
TL;DR
- CoinDCX co-founder Sumit Gupta denied a fresh wallet breach and linked the flagged addresses to its previous hack.
- CoinDCX later said a sweeping process for deposits sent to deprecated addresses failed, causing operational losses that it absorbed.
- ZachXBT and Darcy pointed to post-breach wallet activity that challenged the exchange’s initial explanation.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
CoinDCX’s denial of a fresh hack is facing new scrutiny after on-chain researchers pointed to wallet activity that challenges the exchange’s initial explanation of a suspected $16 million incident.
CoinDCX co-founder Sumit Gupta said the flagged addresses had been compromised during an earlier attack, while ZachXBT said one deposit address remained connected to CoinDCX activity long afterward.
Darcy, chief marketing officer at security firm Salus, separately identified links between wallets on CoinDCX’s proof-of-reserves list and the address identified as the suspected attacker’s.
CoinDCX Says Flagged Wallets Came From Its Previous Hack
Gupta initially rejected claims that CoinDCX’s current wallets had been compromised. “Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don’t spread rumours,” he said.
Gupta said the addresses tagged by Arkham were generated in January 2025 and were compromised during CoinDCX’s July 2025 attack. He said the hackers appeared to be reusing those old addresses. CoinDCX checked its current central and user addresses and found none had sent funds to the flagged wallets, according to Gupta, who added that the exchange’s addresses are publicly listed on its proof-of-reserves page.
CoinDCX later issued a further update on the TQKJQ wallet activity, saying the affected addresses had been compromised during the July 2025 security incident and were subsequently deprecated. The exchange said users had previously been advised not to deposit crypto to those addresses and to verify current deposit addresses through the CoinDCX app or website.
According to CoinDCX, the failure resulted in operational losses that were absorbed by the exchange. It said all affected users who deposited crypto to the deprecated addresses were still credited for those deposits.
CoinDCX maintained that user funds remained safe and said customer assets continued to be held in segregated cold wallets. The exchange said its current central and user addresses were not affected, no funds from active CoinDCX wallets were compromised, and trading activity continued to operate as usual.
The earlier breach cost CoinDCX about $44.2 million and affected an internal wallet used to provide liquidity on a partner exchange, while customer funds remained safe, according to Gupta.
Darcy had raised the latest alert after transfers were observed late on October 21, UTC+8. The movements involved a CoinDCX-reported hot wallet and several deposit addresses sending assets to a single TRON address before the funds were distributed elsewhere.
ZachXBT Challenges CoinDCX’s Old-Wallet Explanation
ZachXBT disputed the claim that the flagged wallets were simply abandoned addresses being reused by attackers. He said CoinDCX deposit address TQKJQ remained in use by a liquidity provider for 10 months after the earlier incident, swept user deposits and received gas from CoinDCX activity as recently as April and May 2026.
“Meaning $15.8M in user deposits was unaccounted for by your team,” ZachXBT wrote.
Gupta then acknowledged the wallet activity cited by ZachXBT and said CoinDCX was examining it further.
“Yes, aware of that. we’re investigating it further, and will share an update soon. We assure that no user funds will be at loss,” Gupta said.
ZachXBT later escalated his criticism of the exchange. He wrote that CoinDCX had publicly and privately denied that a theft occurred before saying:
“Later they disclosed the $16M theft and wasted everyone’s time instead of being transparent with the public initially.”
ZachXBT also said he had helped freeze “6 figures” for CoinDCX and named WazirX and BitBNS while criticizing Indian centralized exchanges.
Darcy Points to CoinDCX Proof-of-Reserves Wallets
Darcy separately said two addresses included in CoinDCX’s latest proof-of-reserves report had transferred funds to the address identified as the suspected attacker’s. Darcy also said the TFLxN… hot wallet continued distributing gas both before and after the incident CoinDCX associated with its earlier compromise.
“If @CoinDCX was not hacked, then it appears to have stolen its users’ assets itself,” Darcy wrote.
After highlighting the continued gas payments, Darcy asked:
“Are you suggesting that the hackers were handling gas funding distribution for you?”
Both statements were allegations based on Darcy’s interpretation of the wallet activity.
Darcy’s tracking also showed part of the transferred USDT reaching centralized exchanges. Some funds went to addresses linked to Huione and Xinbi. Blockchain analytics firm Elliptic has linked those Telegram-based marketplaces to large-scale money laundering.
CoinDCX’s latest explanation attributes the disputed wallet activity to deposits sent to deprecated addresses and a temporary failure in its sweeping process rather than a compromise of its active wallets. ZachXBT and Darcy, however, pointed to continuing links between those deprecated addresses, user deposits, current hot-wallet operations and wallets included in CoinDCX’s proof-of-reserves records.
This article has been refined and enhanced by ChatGPT.
