CoinDCX is under more scrutiny after blockchain investigators found transfers totalling over 15.99 million USDT and 5,784 TRX from wallet addresses linked to the exchange. The funds were moved to a TRON address before being distributed to wallets linked to Binance, OKX, and Gate.

Co-founder Sumit Gupta disputed a new security flaw and blamed the action on hacked addresses in July 2025. Investigator ZachXBT disputed this assertion, citing deposits and subsequent wallet activity that he said are still unaccounted for.

CoinDCX Wallet Transfers Involve Nearly $16 Million

Approximately 15.99 million USDT and 5,783.81 TRX were transferred from addresses designated as CoinDCX hot wallet and deposit addresses to a single address on the TRON network in the flagged transactions. About 15.82 million USDT was involved in the largest transfer.

The receiving address divided the money across several destinations after the initial payments. Chain monitoring connected later transactions to deposit addresses connected to Binance, OKX, and Gate.

Due to the addresses' prior connection with CoinDCX, the transactions garnered notice. Their relationship to the exchange prompted inquiries about whether the transfers were part of a new security incident or behaviour involving wallets that had been compromised in the previous hack.

Who owned the addresses at the time of the transactions cannot be determined solely from the wallet movements. The claim that CoinDCX's existing wallet infrastructure was compromised was refuted.

Users’ funds are safe. ✅

Claims circulating on X regarding certain wallet addresses and transactions are misleading.

The transactions mentioned in recent claims involve old wallet addresses created in January 2025.
These addresses were compromised in July 2025 and have not been used by CoinDCX since.
The activity now being reported relates to these old addresses and does not have any connection with CoinDCX.

Trading & investing continue as usual.

For updates, trust only official CoinDCX channels.
For any queries, reach out to @CoinDCX_Cares

— CoinDCX (@CoinDCX) October 22, 2026

Sumit Gupta Links Flagged Addresses to July 2025 Hack

According to Sumit Gupta, co-founder of CoinDCX, the flagged addresses were created in January 2025 and compromised during the security attack that occurred in July of that same year. He claims that following the assault, the exchange ceased utilising those addresses, and the most recent activity seemed to involve reusing wallets that had previously been compromised.

According to Gupta, CoinDCX examined its user wallet and central wallet addresses and discovered no transfers to the addresses mentioned in the most recent allegations. Additionally, he cited the exchange's publicly accessible proof of reserves, which permits an analysis of its publicised wallet addresses.

The event in July 2025 cost about $44 million in losses. CoinDCX insisted that their investigation was still ongoing and that the most recent transactions did not point to another compromise.

The exchange then clarified that despite warnings, some users had persisted in making deposits into wallet addresses that had been decommissioned. Internal losses resulted from those deposits, which caused issues with the sweeping procedure used to transfer money into the proper wallets. According to CoinDCX, the impacted users received their money back, and the funds were kept in cold storage to ensure the security of ongoing operations.

Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don't spread rumours.

The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the previous hack in July 2025. The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm. We have checked all the present CoinDCX central and user addresses. None of them have sent money to these old addresses.

All the CoinDCX addresses are public and can be seen on our POR link. None of these have sent funds to the above addresses in question and none of the CoinDCX funds got compromised.

Will keep you posted if any new info comes to us as the team is investigating it further. More details to follow from the official CoinDCX handles soon.

— Sumit Gupta (@smtgpt) October 22, 2026

ZachXBT Questions Continued Wallet Activity

ZachXBT, a blockchain investigator, contested the claim that the addresses had not been used since the July 2025 attack. He cited transactions related to user deposits and transfers to CoinDCX's existing publicly accessible hot wallet, as well as activity involving one address that purportedly persisted into 2026.

Additionally, deposits and gas funding activity that were purportedly documented as recently as April and May 2026 were noted by the investigator. These transactions made people wonder if the address had really been abandoned following the last hack.

ZachXBT also questioned the accounting of deposits totalling around $15.8 million related to the activity in the flagged wallet. The apparent discrepancy between CoinDCX's claim that the addresses were no longer in use and the ensuing transactions that were viewable on the blockchain was the main source of his concerns.

Two different reports of the activity remain as a result of the debate. ZachXBT has questioned whether the transaction history supports the assertion that those addresses were no longer involved in its operations, whereas CoinDCX traces the transfers to previously compromised addresses.

CoinDCX Says User Funds Remain Safe

CoinDCX has said that the circulating allegations are false and denied reports of a further hack. The exchange claimed that the addresses mentioned in the most recent complaints had not received money from its current wallet addresses.

Additionally, the company insisted that trading and investment services were carried on as normal. Affected deposits were credited to users in spite of the internal losses resulting from unsuccessful sweeping efforts, according to its explanation regarding deprecated addresses.

CoinDCX referred customers who felt concerned about the situation to its customer care account, @CoinDCX_Cares, and its official communication channels. Additionally, Sumit Gupta stated that the team was looking into the reported activities and would provide more information through proper channels.

The major point of contention is still the discrepancy between CoinDCX's account of the previously compromised addresses and the transaction history that blockchain investigators have pointed out. Although the exchange has insisted that current user money is secure, additional scrutiny has been sparked by concerns regarding the reported deposits' accounting and previous activities.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. CoinDCX Faces Senior-Level Exits Amid Leadership Reshuffle
2. CoinDCX Launches Digital Suraksha Network
3. CoinDCX Announces ₹100 Crore Cyber Safety Push After Fraud Case Fallout
4. After CoinDCX: Where Should Indian Crypto Users Actually Trade?
5. CoinDCX & Goa Police Launch Cyber Awareness Drive

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.