CoinDCX co-founder Sumit Gupta initially denied a fresh breach at the Indian crypto exchange. A security researcher had flagged about $15.99 million in Tether (USDT) moving out of wallets tagged to the platform.
Gupta said the addresses belonged to CoinDCX before its July 2025 hack and were compromised in that attack. However, on-chain investigator ZachXBT later said one of those deposit addresses was still sweeping user funds to CoinDCX’s current hot wallet as recently as May 2026. Gupta acknowledged the point and said no user funds would be lost.
A $15.8 Million Transfer Sets Off the Alarm
Darcy, chief marketing officer at security firm Salus, raised the alert on X on October 22.
According to the post, CoinDCX’s reported hot wallet and several deposit addresses sent funds to a single TRON address late on October 21 (UTC+8). The outflow totaled roughly 15.99 million USDT and 5,783.81 TRON (TRX).
The largest single transfer moved about 15.82 million USDT. The receiving address then split the money across multiple wallets.
After several rounds of splitting, the funds reached deposit addresses on Binance, OKX, Gate, and other exchanges, Darcy said.
However, CoinDCX’s leadership disputed that any of those wallets still belonged to the exchange.
Follow us on X to get the latest news as it happens
CoinDCX Traces the Flagged Wallets to Last Year’s Breach
Gupta replied to Darcy’s post less than three hours after it went live.
“Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don’t spread rumours,” he said.
He explained that Arkham had tagged the addresses to CoinDCX. However, the exchange generated them in January 2025, and they were compromised during the July 2025 attack.
In Gupta’s view, the hackers appear to be reusing those old addresses. He added that the team checked every current central and user address on the exchange.
None of them had sent funds to the flagged addresses, he said. Gupta also noted that all CoinDCX addresses are public on its proof-of-reserves (PoR) page.
The earlier breach cost CoinDCX about $44.2 million in July 2025. At the time, Gupta said attackers hit an internal wallet used for liquidity on a partner exchange, and customer funds stayed safe.
ZachXBT Challenges the ‘Old Wallet’ Explanation
On-chain investigator ZachXBT disputed Gupta’s account in a post on X.
He said a CoinDCX deposit address beginning with “TQKJQ” was used by a liquidity provider (LP) for 10 months after the July 2025 incident. According to ZachXBT, the address swept user deposits to CoinDCX’s current public hot wallet and received gas fees as recently as April and May 2026.
“Meaning $15.8M in user deposits was unaccounted for by your team,” he wrote.
ZachXBT also questioned the track record of Indian exchanges, naming WazirX and BitBNS alongside CoinDCX. WazirX lost over $230 million in a July 2024 hack.
Gupta replied directly to the post.
“Yes, aware of that. we’re investigating it further, and will share an update soon. We assure that no user funds will be at loss,” he said.
Earlier, Gupta had said the flagged addresses no longer belonged to CoinDCX. This reply marks a shift from that position.
Darcy Points to Wallets on CoinDCX’s Own Reserve List
Darcy then raised the stakes.
“If @CoinDCX was not hacked, then it appears to have stolen its users’ assets itself,” the Salus CMO wrote.
According to Darcy, two addresses listed in CoinDCX’s latest PoR report sent funds to the address identified as the hacker’s (TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT). The two addresses are:
- TFLxNHunhEizmeEdiMyA3r2XGLSKaEznGd
- TM5r1bNJ2TjZwfS757tPPtr84MwtEjL9qN
Darcy added that the hot wallet, TFLxN…, kept distributing 15 TRX for gas both before and after what CoinDCX describes as the hack.
“Are you suggesting that the hackers were handling gas funding distribution for you?” Darcy asked.
Darcy’s tracking shows these amounts reaching exchanges:
- OKX: about 5.47 million USDT, plus a separate 50,000 USDT
- Binance: about 2.02 million USDT
- Gate: about 1.39 million USDT
Some funds also went to addresses linked to Huione and Xinbi. Blockchain analytics firm Elliptic has tied these Telegram-based marketplaces to large-scale money laundering.
CoinDCX had not publicly addressed Darcy’s latest claims at the time of writing. Gupta said the exchange’s official accounts will share more details soon.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights
