India’s largest cryptocurrency exchange, CoinDCX, has rejected claims that its active wallets were hacked after blockchain investigators identified roughly $16 million in transfers from addresses associated with the platform.
The questioned transactions involved USDT, a stablecoin designed to track the U.S. dollar, and TRX, the native token of the Tron blockchain. The funds were sent to one Tron address before being divided among several other wallets, according to the blockchain investigator known as Darcy. The largest single transfer was 15,819,002 USDT.
CoinDCX said the addresses involved were created in January 2025 and compromised during a hack in July that year. The exchange said it stopped using them after that incident and that the activity now being examined did not come from its active wallets. CoinDCX was previously exploited for about $44 million in July 2025.
According to CoinDesk, the exchange’s position is that the hackers who took control of the old addresses are now reusing them, creating the appearance of a fresh breach. Chief executive Sumit Gupta also described the claims as a false alarm on X.
Why the wallet activity raised concerns
The initial alarm focused on how crypto exchanges handle deposits. Customers are generally assigned individual blockchain addresses to which they send digital assets. Exchanges then periodically sweep those deposits into wallets controlled by the platform.
Some funds may be moved to a hot wallet, which is connected to the internet and used for routine withdrawals. Other assets are stored in cold wallets, which are kept offline. Because blockchain transfers are publicly visible, unusual movement from addresses linked to an exchange can quickly prompt speculation about theft or a security failure.
Darcy said the transfers came from CoinDCX’s hot wallet and multiple deposit addresses. The investigator’s post treated the approximately $16 million outflow as a possible theft and raised fears that CoinDCX had suffered another attack.
CoinDCX said, however, that its current central and user addresses were not affected. It also said that no funds from its active wallets had been compromised and that customer assets remained in cold storage.
Investigator disputes exchange’s explanation
The exchange’s account was challenged by ZachXBT, a prominent on-chain investigator. He pointed to an address labeled TQKJQ and said it remained in use after the July 2025 incident.
ZachXBT said the address had been used by a liquidity provider for 10 months after the earlier hack. He also said it continued to receive customer deposits and blockchain transaction fees, known as gas, as recently as April and May 2026, with funds being swept to CoinDCX’s current public hot wallet.
That claim directly conflicts with CoinDCX’s statement that the addresses were no longer in use. The exchange said it had notified users after the July incident not to send funds to the compromised addresses, which it now describes as deprecated, or retired.
CoinDCX acknowledged that some users nevertheless continued depositing to those older addresses rather than using the latest addresses assigned to them. It said its sweeping process is intended to capture such deposits, but that the process failed temporarily. The exchange characterized the resulting impact as an operational loss rather than a compromise of its active wallets.
CoinDCX said it credited every affected user and absorbed the losses. It added that trading was continuing as normal.
Moneyiar market picture
Moneyiar market data at 08:03-08:04 on October 24, 2026, showed a broadly weaker picture among the four listed crypto assets, with one exception over the previous 24 hours:
- Chainlink (LINK): $11.7063042166, down 3.75% over 24 hours and 4.3% over seven days, as of 08:04.
- BAS (BAS): $0.0170209869, up 0.88% over 24 hours but down 10.97% over seven days, as of 08:03.
- Walrus (WAL): $0.0356111094, down 6.49% over 24 hours and 16.77% over seven days, as of 08:03.
- Flow (FLOW): $0.0278641003, down 3.22% over 24 hours and 12.43% over seven days, as of 08:03.
The CoinDCX dispute illustrates the difficulty of interpreting blockchain activity after a security incident. Transfers from addresses historically linked to an exchange may look like a new breach, while the exchange may regard those addresses as retired and attribute the movement to an earlier compromise or a breakdown in deposit handling. The competing accounts leave the central question focused on whether an old address remained operational and connected to current exchange infrastructure.
