Indian cryptocurrency exchange CoinDCX has denied allegations of a new hack amounting to approximately $15.8 million and confirmed that customer funds remain secure. Blockchain investigator ZachXBT challenged the company's explanations, claiming that compromised deposit addresses continued to process funds after the incident in July 2025. On October 22, CoinDCX released a statement saying that the transactions were linked to addresses created in January 2025 and compromised in July 2025. CoinDCX stated that the mentioned addresses are no longer part of its active infrastructure. However, ZachXBT claimed that at least one of these addresses continued to receive deposits and interact with CoinDCX's hot wallets months after the previous incident. He also alleged that about $15.8 million in deposits remained unaccounted for by the exchange.
The dispute intensified after blockchain researcher Darcy pointed to transactions amounting to approximately 15.99 million USDT and 5,783.81 TRX on the TRON network, which occurred on October 21 around 23:35 UTC+8. According to him, funds from addresses identified as CoinDCX deposit addresses and hot wallets moved to a separate TRON address. The largest individual transfer, according to Darcy, was 15,819,002 USDT, and the recipient, he claimed, distributed the funds across several wallets, some of which eventually reached deposit addresses on Binance, OKX, Gate, and other exchanges through intermediary addresses. However, the researcher's findings do not independently establish whether the transfers were unauthorized or whether the receiving wallets belonged to the attacker.
CoinDCX CEO Sumit Gupta responded to the allegations, stating: "CoinDCX wallets were not compromised," and urged users not to spread rumors while the company continues to investigate the transactions. According to him, the addresses identified through Arkham Intelligence previously belonged to CoinDCX but were compromised during the July 2025 attack; the attackers are likely reusing these addresses, which he called a possible false alarm. Gupta reported that the exchange checked current operational and client addresses and found no transfers from them to the addresses mentioned in the allegations, referring to public proof of reserves data.
ZachXBT then challenged the exchange's version, pointing to transactions with the deposit address TQKJQ on the TRON network. He claimed that this address remained in use by a liquidity provider for approximately 10 months after the July 2025 incident, despite CoinDCX describing the related wallets as compromised. ZachXBT stated that the address continued to receive deposits and gas transfers up until April and May 2026, and the funds went to wallets publicly identified as current CoinDCX hot wallets. He also alleged that about $15.8 million in client deposits remained unaccounted for. However, the available screenshots do not independently establish ownership of each wallet, the purpose of the transactions, or confirmed client losses; CoinDCX at the time of publication has not publicly reconciled the specific transaction history provided by ZachXBT with its explanation.
This material is prepared solely for informational purposes and does not constitute financial advice or a recommendation.