CoinDCX Denies $16M Hack Rumors, Tracing Wallet Outflows to 2025 Breach

CoinDCX Denies New $16 Million Exploit – Executive Traces Suspicious Wallet Movements to Historic 2025 Breach

Key Takeaways

• Security researchers flagged a transfer of roughly 15.99 million USDT from wallets historically associated with CoinDCX.
• CoinDCX co-founder Sumit Gupta confirmed the exchange has not suffered a new security breach.
• The alerted wallets were compromised during a prior incident in July 2025 and no longer belong to the active exchange infrastructure.
• Internal audits show no funds left any current central or user addresses on the platform.

Security Firm Salus Flags Large Outflows to TRON Network

An alert emerged on October 22 regarding significant fund movements from wallets tagged to the Indian crypto exchange CoinDCX. Darcy, the chief marketing officer at the security firm Salus, posted the initial warning on the social media platform X. The security researcher detailed that a reported hot wallet and several associated deposit addresses initiated transfers late on October 21.

These outbound transactions moved a combined total of roughly 15.99 million Tether (USDT) and 5,783.81 TRX to a single TRON network address. Blockchain data indicates that the largest individual transaction within this cluster moved about 15.82 million USDT in one execution.

The receiving TRON address immediately began splitting the consolidated funds across multiple secondary wallets. Darcy reported that after several rounds of division, the assets ultimately reached deposit addresses on major cryptocurrency exchanges. The identified destination platforms included Binance, OKX, and Gate.

CoinDCX Leadership Rejects Claims of Fresh Security Incident

Company executives quickly responded to the public alert to clarify the status of the exchange infrastructure. CoinDCX co-founder Sumit Gupta replied directly to the security researcher’s post less than three hours after it appeared online. Gupta explicitly stated that the information was incorrect and urged the community not to spread rumors regarding a new breach.

Gupta explained that the blockchain analytics platform Arkham had previously tagged the addresses in question to CoinDCX. The exchange had originally generated these specific wallets in January 2025. Management clarified that these addresses fell out of the company control during a severe security incident in July 2025.

The exchange leadership assesses that the malicious actors responsible for the summer breach are now reusing those old, compromised addresses to move funds. Gupta emphasized that the flagged wallets no longer represent the operational infrastructure of the current exchange.

Internal Audits Confirm Current Customer Funds Remain Unaffected

Following the public alert, the technical team at CoinDCX conducted an immediate review of its systems. The internal investigation checked every current central wallet and individual user address operating on the exchange. Gupta stated that the audit confirmed none of the active company addresses had sent any funds to the flagged TRON destination.

The exchange offers a mechanism for users to verify the integrity of the platform assets independently. All active CoinDCX addresses are publicly listed on the company proof-of-reserves page. This public listing allows external monitors to confirm that the active reserves remain static and uninvolved in the recent high-volume transactions.

CoinDCX continues to investigate the blockchain movements associated with the old wallets. Gupta indicated that the official exchange accounts will release more detailed information regarding the situation in the near future.

Historic Context Points to July 2025 Liquidity Exploit

The recent wallet activity directly links back to a major financial loss suffered by the exchange over a year ago. That earlier breach cost CoinDCX approximately $44.2 million when attackers successfully compromised platform systems in July 2025.

During that historical incident, attackers specifically targeted an internal wallet. The company used that specific wallet to maintain liquidity on a partner exchange rather than for storing direct user deposits. Customer funds remained secure during the July 2025 exploit. The latest movements of the 15.99 million USDT represent a delayed transfer of assets stolen during that previous event.

Our Assessment

The rapid movement of nearly 16 million USDT highlights how malicious actors often hold stolen funds for extended periods before attempting to launder them through active centralized exchanges. Security firms correctly identified the on-chain activity connected to old exchange tags, but the immediate response from CoinDCX leadership clarifies the timeline of the actual compromise. By maintaining a public proof-of-reserves page, the exchange provides the necessary transparency to prove that current operational and user wallets remain unbreached. The successful tracing of these funds to platforms like Binance and OKX may prompt those destination exchanges to monitor or freeze the accounts receiving the stolen assets.