CoinDCX disputes $16 million outflow stemmed from old compromised addresses

India’s largest crypto exchange has pushed back against allegations that its active wallets were breached, though blockchain analysts contest the company’s account of what happened to addresses tied to a prior hack. The dispute raises questions about whether CoinDCX fully contained fallout from its July 2025 security incident.

• CoinDCX denied active wallets were compromised after $16 million in suspicious outflows were flagged by blockchain investigators on Wednesday.
• The exchange attributed the transfers to addresses it said were compromised in July 2025 and abandoned, but analyst ZachXBT said at least one address continued receiving deposits into spring 2026.
• CoinDCX acknowledged a temporary failure in sweeping deposits from retired addresses caused operational losses, which it absorbed by crediting affected users.

• $16 million in USDT and TRX tokens moved in suspicious outflows flagged by blockchain analysts Wednesday
• $44 million stolen in July 2025 hack from which CoinDCX claims old addresses originated
• 15,819,002 USDT in largest single transaction routed to a single Tron address before being split across wallets
• April & May 2026 period when one allegedly retired address still received gas fees and swept user deposits

According to reporting by CoinDesk, CoinDCX moved to contain damage to its reputation Thursday after an X user named Darcy flagged roughly $16 million in USDT stablecoin and TRX token moving out of wallets associated with the exchange. The outflows routed through a single intermediary Tron address, which then distributed the funds across multiple destination wallets, triggering immediate speculation of a fresh breach at India’s largest cryptocurrency exchange.

CoinDCX’s statement that old addresses were abandoned after the July incident

CoinDCX’s spokesperson told CoinDesk that the addresses involved dated to January 2025 and had been compromised during the exchange’s July 2025 hack, which resulted in $44 million in losses. The company maintained it had discontinued use of those wallets and that current operational addresses remained secure.

“Current CoinDCX central and user addresses have not been impacted, and no CoinDCX funds from active wallets have been compromised,” the spokesperson said. CEO Sumit Gupta reinforced the denial on X, suggesting the original hackers were reusing the old wallet addresses to create a false impression of a new breach.

The exchange told users not to deposit to the compromised addresses after July 2025 and has since labeled them “deprecated,” or retired.

Blockchain analyst ZachXBT disputes the claim that addresses went unused after July

On-chain investigator ZachXBT contested CoinDCX’s account, arguing that at least one of the purportedly abandoned addresses, labeled TQKJQ, remained active well into 2026. He said the address continued to receive customer deposits and pass them to CoinDCX’s current operational wallet as recently as April and May 2026, with activity including gas fee transactions tied to liquidity providers.

If accurate, this would contradict the exchange’s assertion that the old addresses had been fully decommissioned.

CoinDCX acknowledges deposit-sweeping process failed temporarily

When pressed on whether the address had actually remained in active use, CoinDCX acknowledged a gap in its processes. The exchange said that despite issuing notifications after the July hack, some users continued sending funds to the deprecated addresses instead of using current deposit addresses. The sweep mechanism designed to move all deposits into centralized wallets failed during a period, allowing funds to accumulate.

CoinDCX said it compensated every affected user and that all customer funds remain in cold storage offline wallets.

Trading continues without interruption, and the exchange has not reported any compromise of its hot wallets or current active addresses.

The BlockWest read. CoinDCX’s operational loss and credit to users signals the company was managing known vulnerabilities in legacy infrastructure rather than responding to a new compromise. The gap between management’s account and ZachXBT’s on-chain evidence points to communication failures about which addresses were live and when, a material risk for custody-holding platforms handling user deposits at scale.

CoinDCX has not announced a formal security audit or third-party review of its current wallet infrastructure to corroborate its claims that active addresses remain uncompromised. Whether the exchange or additional independent investigators will provide on-chain evidence settling the dispute over deposit address usage timing remains unresolved.

BlockWest is a news publication. Nothing here is investment advice. Read our disclaimer and editorial policy.