India's CoinDCX denies hack after analysts flag $16 million in suspicious outflows

Exchange says addresses were compromised in a 2025 attack; a prominent investigator says one was still in use this year

By LineZotpaper

Published23 October 2026

Updated23 October 2026

Read Time3 min

Sources2 outlets

India's largest crypto exchange, CoinDCX, has denied that its active wallets were compromised after blockchain analysts flagged about $16 million in suspicious outflows from wallets linked to the exchange, with the two sides disputing whether the addresses involved had been abandoned after a previous hack.

The dispute began when an X user named Darcy highlighted a large outflow from CoinDCX's hot wallet and several of its deposit addresses on Wednesday, totalling about $16 million in USDT, a dollar-pegged stablecoin, and Tron's TRX token. Darcy said the funds were all sent to a single Tron address, with the largest transaction at 15,819,002 USDT, and that the address then split the money across several wallets. The post flagged the outflow as a suspected theft, raising fears of a fresh hack.

CoinDCX rejected that characterisation. "The transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since," a spokesperson told CoinDesk. "Current CoinDCX central and user addresses have not been impacted, and no CoinDCX funds from active wallets have been compromised."

Chief executive Sumit Gupta pushed back on X, saying the July 2025 hackers appear to be reusing the old wallet addresses and calling the alarm false. The exchange was exploited in July 2025 for about $44 million.

On-chain investigator ZachXBT challenged that position, saying at least one of the flagged addresses, labelled TQKJQ, was still in use. "CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet," he said. A liquidity provider, or LP, is a firm that supplies buy and sell orders to an exchange, while gas is the fee paid to move tokens on a blockchain.

CoinDCX said it had told users after the July 2025 hack not to deposit funds to such compromised addresses, which it now calls deprecated. "Despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones," the spokesperson said. The exchange said a temporary failure in its process for moving deposits from retired addresses caused operational losses, which it absorbed after crediting affected users. It said customer assets sit in cold wallets, its current addresses were not hit, and trading continues as usual.

Analysis

Why This Matters

The dispute tests whether user funds on India's largest exchange are secure, given CoinDCX was already hit by a roughly $44 million exploit in July 2025.
If the investigator's account is correct, deposits may have been flowing into a compromised address for months without being properly swept, raising questions about the exchange's controls.
The outcome could affect confidence in Indian crypto platforms and how exchanges handle retired deposit addresses after a breach.

Background

Crypto exchanges typically give each user a personal deposit address and regularly "sweep" those deposits into main wallets, moving most funds into offline cold storage for safekeeping while keeping a smaller hot wallet for withdrawals. CoinDCX, which describes itself as India's largest exchange, was exploited in July 2025 and says it then told users to stop using affected addresses. The exchange now calls such addresses deprecated, meaning retired.

Key Perspectives

CoinDCX: The flagged activity involves old addresses that were compromised in July 2025 and have not been used by the exchange since. It says no active wallets were impacted, affected users were credited, and the losses were absorbed by the exchange.

Independent investigators: ZachXBT says at least one flagged address, TQKJQ, was still operating as a deposit route well into 2026, with deposits being swept to CoinDCX's current hot wallet as recently as April and May. This directly contradicts the claim that the address was abandoned.

Critics and skeptics: The central concern is that an address tied to a known breach continued to receive and forward funds for months, which would point to weak deposit handling procedures rather than a benign false alarm.

What to Watch

Whether CoinDCX publishes details or proof that affected users were fully credited and that current addresses were untouched.
Any further on-chain analysis of the flagged Tron address and its connections to wallets used after July 2025.
Whether Indian regulators or users pursue further inquiries, and whether any users report losses from deposits made to deprecated addresses.

Sources

Old wallet addresses trap CoinDCX users, triggering potential losses · CryptoSlate
India's largest exchange denies hack after sleuths pointed to $16 million in suspicious outflows · CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data

Checked

11 claims in this story checked against 1 source: 10 supported.

Show each claim

SupportedCoinDCX denied that its active wallets were compromised after analysts flagged about $16 million in suspicious outflows.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “CoinDCX denied that its active wallets were compromised after blockchain investigators flagged about $16 million in suspicious outflows from addresses linked to the Indian crypto exchange.”
SupportedThe exchange said the addresses had been compromised in July 2025 and had not been used by CoinDCX since.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “These addresses were compromised in July 2025 and have not been used by CoinDCX since.”
SupportedAn investigator said at least one flagged address was still in use in 2026.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “He said at least one of those addresses, labeled TQKJQ was still in use.”
Partly supportedThe spokesperson’s first quoted statement ends “since,”.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “These addresses were compromised in July 2025 and have not been used by CoinDCX since. The activity now being reported relates to these old addresses and does not have any connection with CoinDCX.”
SupportedDarcy highlighted an outflow on Wednesday totalling about $16 million in USDT and TRX.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “It totaled about $16 million in USDT, a dollar-pegged stablecoin, and Tron’x TRX token.”
SupportedDarcy said the funds went to one Tron address, and the largest transaction was 15,819,002 USDT.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “All of it was sent to a single Tron address, Darcy said, with the largest transaction at 15,819,002 USDT.”
SupportedThe CEO said the July 2025 hackers seemed to be reusing old wallet addresses and called the alarm false.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “CoinDCX’s CEO Sumit Gupta pushed back on X, saying the July 2025 hackers seem to be reusing the old wallet addresses and calling it a false alarm.”
SupportedZachXBT said address TQKJQ was used by a liquidity provider for 10 months after the July 2025 incident and interacted with CoinDCX’s current hot wallet as recently as April and May 2026.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet,”
SupportedCoinDCX was exploited in July 2025 for about $44 million.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “CoinDCX was exploited before , in July 2025, for about $44 million.”
SupportedCoinDCX said a temporary failure in moving deposits from retired addresses caused operational losses, which it absorbed after crediting affected users.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “CoinDCX acknowledged that a temporary failure in its process for moving deposits from retired addresses caused operational losses, which it absorbed after crediting affected users.”
SupportedCoinDCX said customer assets sit in cold wallets, its current addresses were not hit, and trading continues as usual.CoinDesk: Bitcoin, Ethereum, Crypto News and Price Data: “It said customer assets sit in cold wallets and that its current addresses were not hit. Trading continues as usual.”