CoinDCX Admits Operational Losses in Wallet Transfer Issue

CoinDCX has confirmed it absorbed certain operational shortfalls after a process to withdraw funds from compromised deposit addresses failed to complete as planned. The Indian exchange said it credited all affected user accounts with the impacted assets and stressed that its active wallet infrastructure remained intact.

The development follows alerts from blockchain investigators who tracked movements of approximately $16 million in USDT and small amounts of TRX on the TRON network. These funds originated from addresses previously linked to the exchange and later moved toward other major platforms.

Investigators Flag Suspicious Outflows

On October 21, blockchain security expert Darcy traced roughly 15.99 million USDT and 5,784 TRX leaving addresses associated with CoinDCX hot wallets and deposit addresses. The largest single transfer reached about 15.82 million USDT, with the assets then distributed across multiple wallets before reaching deposit addresses on Binance, OKX and Gate.io.

The transfers occurred in a single transaction on the TRON blockchain and raised immediate questions about whether they reflected an unauthorized movement or activity from lingering compromised wallets.

Exchange Links Transfers to 2025 Security Incident

CoinDCX identified the flagged addresses as having been generated in January 2025 and compromised during its July 2025 breach, when approximately $44 million was stolen from an internal liquidity account. The exchange stated that these older addresses had not been used by its systems since the incident and that no current central or user wallets had sent funds to them.

The company added that customer assets continue to reside in segregated cold storage and that trading operations remain unaffected. It emphasized that user funds are secure and urged reliance on official channels for any updates.

CEO Responds to Allegations of a Second Breach

CoinDCX co-founder and CEO Sumit Gupta directly addressed the claims on X, describing them as misleading and confirming that the wallets in question belonged to the prior hack rather than a new compromise.

Gupta also noted that the exchange would provide additional details through official communications and pointed to its public proof-of-reserves data as further reassurance.

Critics Question Exchange's Account of Wallet Usage

Blockchain investigator ZachXBT challenged the company's explanation, pointing to on-chain records showing that at least one of the addresses had remained active with a liquidity provider for roughly 10 months after the 2025 incident. He cited continued transfers of user deposits and gas fees into CoinDCX's current public hot wallet as recent as April and May 2026.

ZachXBT argued that the exchange had failed to account for approximately $15.8 million in customer deposits and questioned whether the activity represented unclaimed funds from the earlier breach or something else entirely. Another security researcher, Taylor Monahan, expressed similar skepticism about the exchange's account of the transaction sequence.

CoinDCX had not publicly reconciled these specific records with its latest statement at the time of reporting.

Context of Earlier $44 Million Loss

The current developments build on the July 2025 incident, in which attackers exploited an internal liquidity account to steal around $44 million. CoinDCX attributed the breach to a sophisticated server compromise and stated that customer cold wallets were never affected.

The exchange absorbed the loss from its treasury reserves, paused certain Web3 services temporarily, and later launched a recovery bounty program offering up to 25 percent of recovered funds, capped at $11 million. It has also maintained a customer protection fund established after the 2024 WazirX breach.

Industry observers have noted that the exchange's handling of both incidents underscores ongoing challenges for centralized platforms in managing legacy wallet security and demonstrating full asset segregation to users.