CoinDCX Rejects New $16M Security Breach Claims, Says Old Wallet Activity Is Unrelated

• CoinDCX denies new $16M crypto hack allegations, saying the flagged wallets were compromised in July 2025 and have not been used by the exchange since.
• Blockchain investigators flagged approximately 15.99 million USDT and 5,783.81 TRX in transfers on October 21.
• ZachXBT questioned CoinDCX’s explanation, alleging that a previously compromised address remained active for months after the breach.

One of India’s leading cryptocurrency exchanges, CoinDCX, has denied allegations of a new security breach after blockchain investigators flagged approximately $16 million in USDT and TRX transfers from wallet addresses reportedly linked to the platform.

The transactions, reported on October 21, have raised fresh questions about CoinDCX’s July 2025 security breach and the status of its previously compromised wallets. Responding to the claims in a statement on X, CoinDCX said “users’ funds are safe” and described the reports surrounding the wallet addresses and transactions as “misleading.”

The exchange explained that the addresses were created in January 2025 and compromised during the July 2025 incident. According to CoinDCX, these wallets have not been used by the platform since then.

“The activity now being reported relates to these old addresses and does not have any connection with CoinDCX,” the company said. It added that trading and investing on the platform continued as usual.

CoinDCX co-founder Sumit Gupta also rejected the allegations, saying the addresses flagged by Arkham previously belonged to the exchange but were compromised in the 2025 breach. He suggested that hackers may be reusing those addresses, causing a false alarm.

Gupta said the exchange reviewed its current company and user wallet addresses and found no transfers to the old wallets. He added that no CoinDCX funds had been compromised and that the team was continuing its investigation.

Old Wallet Activity Raises Questions

The denial follows claims by blockchain security investigator Darcy, associated with Salus, who reported transfers involving approximately 15.99 million USDT and 5,783.81 TRX at around 23:35 UTC on October 21. The reported transactions raised concerns about possible suspicious activity involving wallets linked to CoinDCX.

Following that, Blockchain investigator ZachXBT questioned CoinDCX’s explanation of its earlier security breach. He alleged that an address identified as TQKJQ continued receiving deposits for around 10 months after the July 2025 incident, with activity reportedly recorded in April and May 2026.

ZachXBT also claimed that the address had connections to CoinDCX’s current public hot wallets. He argued that this activity raises questions about the company’s statement that the compromised addresses were no longer in use.

However, the reported blockchain activity does not, by itself, establish that CoinDCX suffered a new security breach or that customer funds are missing. The exchange maintains that the addresses involved are old and that the transactions have no connection to its operations.

The controversy follows CoinDCX’s July 19, 2025, security incident, when an internal operational account used for liquidity provisioning on a partner exchange was compromised. In its official incident report, the company said customer wallets were unaffected and that it would cover the financial exposure from its own treasury reserves.

The latest dispute centers on whether the wallet activity identified by investigators contradicts CoinDCX’s explanation. While the exchange maintains that its funds remain secure, the competing claims have not been independently resolved. No new CoinDCX breach has been confirmed by the evidence cited in these reports.