What to Know

  • CoinDCX denied that its active wallets were compromised after blockchain investigators flagged about $16 million in suspicious outflows from wallets linked to the exchange.
  • The India-based crypto exchange said the transactions involved old wallet addresses created in January 2025 and compromised in July 2025.
  • CoinDCX said current central and user addresses were not impacted and that no funds from active wallets were compromised.
  • An X user named Darcy highlighted a large outflow involving USDT and Tron’s TRX token, with the largest transaction totaling 15,819,002 USDT.
  • The funds were reportedly sent to a single Tron address and then split across several wallets.
  • CoinDCX was previously exploited in July 2025 for about $44 million.
  • CoinDCX CEO Sumit Gupta characterized the latest concerns as a false alarm and said the prior attackers appeared to be reusing old wallet addresses.
  • On-chain investigator ZachXBT challenged the exchange’s framing, saying at least one address had continued handling deposits and interacting with CoinDCX’s current public hot wallet into April and May 2026.
  • CoinDCX said some users continued depositing to deprecated addresses despite prior notifications and that a temporary failure in its sweep process caused operational losses absorbed by the exchange.
  • The exchange said affected users were credited, customer assets remain in cold wallets, and trading continues as usual.

CoinDCX Pushes Back Against Fresh Hack Fears

CoinDCX has denied that its active wallets were hacked after blockchain sleuths raised concerns over about $16 million in suspicious outflows from wallets linked to the Indian crypto exchange. The company’s response sought to separate the latest on-chain activity from its current operating infrastructure, arguing that the transactions came from old wallet addresses rather than active central or user wallets.

The exchange said the addresses tied to the flagged transactions were created in January 2025 and were compromised during a July 2025 hack. In CoinDCX’s framing, those wallets had already been retired, and the latest movement of funds does not indicate that its present-day wallet system was breached. The company said current CoinDCX central and user addresses have not been affected and that no CoinDCX funds from active wallets have been compromised.

The statement was aimed at calming fears of a new security incident at a major Indian exchange, particularly because CoinDCX had already suffered an exploit in July 2025 for about $44 million. For crypto users, the distinction between an active wallet breach and movement from old compromised addresses is significant. An active wallet compromise can suggest immediate risk to ongoing exchange operations, while activity from deprecated addresses may point to residual operational or user-deposit exposure tied to previously known infrastructure.

How the Suspicious Outflows Were Flagged

The concerns began when an X user named Darcy highlighted a large outflow from CoinDCX’s hot wallet and several deposit addresses. The movement totaled about $16 million in USDT, a dollar-pegged stablecoin, and Tron’s TRX token. The funds were sent to a single Tron address, with the largest transaction totaling 15,819,002 USDT, before that address split the money across several different wallets.

For exchanges, deposit addresses are the unique blockchain addresses assigned to users so they can send assets into the platform. Exchanges typically move those deposits through a process known as sweeping, where incoming funds are collected from individual deposit addresses and moved into exchange-controlled wallets. Some funds are maintained in hot wallets for routine withdrawals, while larger reserves are commonly held in cold wallets that are kept offline.

Because sweeping activity is a normal part of exchange operations, large flows from deposit addresses do not automatically prove a hack. However, when funds appear to move from addresses associated with an exchange into a single external destination and then split across multiple wallets, on-chain analysts often treat that pattern as suspicious. In this case, the visibility of the movement on Tron and the size of the transaction quickly drew market attention.

Exchange Says Deprecated Addresses Were Involved

CoinDCX’s central defense is that the activity relates to deprecated addresses. In operational terms, a deprecated wallet address is one an exchange no longer wants users to use, often because it has been replaced, migrated, or associated with previous risk. CoinDCX said the addresses in question were compromised in July 2025 and have not been used by the exchange since.

The exchange also said it had previously notified users not to deposit funds to those compromised addresses. However, CoinDCX acknowledged that some users continued sending assets to the old deposit addresses instead of using updated ones. That created a lingering problem: even if an exchange retires an address, users may still have it saved in wallet apps, address books, scripts, or business payment flows.

CoinDCX said its sweeping process is intended to catch such deposits, but that it failed for a period. The exchange characterized the result as operational losses rather than a fresh compromise of active wallets. It said affected users were credited and that it absorbed the losses. The exchange also emphasized that customer assets are held in cold wallets and that trading continues as usual.

On-Chain Investigator Questions the Timeline

The exchange’s explanation did not fully settle the debate. ZachXBT, a well-known on-chain investigator, challenged the claim that the relevant addresses were no longer in use. He said at least one address, identified by the label TQKJQ, had continued to function after the July 2025 incident.

According to the investigator’s on-chain framing, the address was in use by a liquidity provider for 10 months after the July 2025 incident and swept user deposits, while also receiving gas as recently as April and May 2026 to CoinDCX’s current public hot wallet. In plain terms, that allegation suggests the address was not merely abandoned infrastructure sitting idle after the prior compromise, but one that continued to participate in deposit and wallet activity well into 2026.

CoinDCX’s position remains that users had been told not to deposit to those addresses and that the addresses were deprecated. The tension between those claims and the on-chain interpretation reflects a broader challenge in crypto: blockchain data can show where funds moved and when, but interpreting whether an address is active, retired, user-driven, automated, or operationally controlled can require internal exchange context that is not always publicly visible.

Why Deposit Address Management Matters

The incident highlights a persistent risk for centralized crypto exchanges: address lifecycle management. When an exchange changes deposit infrastructure after a security incident, it must not only secure new wallets but also make sure old addresses cannot create future exposure. Users may continue sending funds to previously used addresses, particularly if those addresses were whitelisted or embedded in automated systems.

In crypto markets, deposit addresses can feel permanent to users because blockchains do not expire addresses by default. A retired address can still receive funds if someone sends assets to it. That creates a difficult operational problem. If the exchange no longer controls or safely manages the address, user funds can be at risk. If the exchange still monitors the address, it must maintain secure sweeping and reconciliation systems to prevent stranded deposits or unauthorized movement.

CoinDCX said sweeping is designed to address precisely this issue. When a user mistakenly sends funds to an old deposit address, the exchange can attempt to collect and credit those assets. The company’s acknowledgment that the process failed for a period is important because it frames the latest issue as a process breakdown linked to retired infrastructure rather than a compromise of its active wallets.

Market Reaction Centers on Trust and Transparency

For exchange users, the key question is whether their funds remain safe and accessible. CoinDCX has said affected users were credited, active wallets were not compromised, and trading continues as usual. Those assurances are likely to be closely scrutinized by market participants because prior exchange security events across the industry have shown how quickly uncertainty can damage confidence.

Transparency around wallet status is particularly important after a known exploit. Market participants often expect exchanges to clearly separate active wallets, deprecated addresses, compromised infrastructure, and user deposit flows. When on-chain investigators observe activity that appears to blur those categories, exchanges can face pressure to provide more detailed explanations.

The CoinDCX case also shows the growing role of independent blockchain analysis in crypto market oversight. On-chain sleuths can spot movements across public ledgers in real time, raising alerts before companies provide formal updates. That visibility can improve accountability, but it can also create confusion when wallet labels, internal processes, and historical infrastructure changes are not fully public.

What Comes Next for CoinDCX

CoinDCX’s immediate priority is likely to be restoring confidence that its wallet architecture is secure and that deposits are being routed properly. The exchange has already stated that current central and user addresses were not hit, that customer assets sit in cold wallets, and that affected users were credited. Those points directly address the main concerns raised by users after the suspicious outflows were flagged.

At the same time, the unresolved question is whether any deprecated address continued to interact with current infrastructure in a way that could confuse users or outside analysts. If old addresses remained linked to sweeping routes or liquidity provider activity into 2026, market participants may press for more clarity on how and when those addresses were fully removed from production systems.

For now, CoinDCX has denied a new active-wallet hack and characterized the incident as involving deprecated addresses connected to a prior compromise. The debate has shifted from whether active wallets were breached to whether the exchange’s cleanup and deposit-handling processes after the July 2025 incident were robust enough to prevent further losses and confusion.

Frequently Asked Questions (FAQs)

Did CoinDCX say its active wallets were hacked?

No. CoinDCX denied that its active wallets were compromised and said current central and user addresses were not impacted.

How much money was flagged in the suspicious outflows?

Blockchain sleuths flagged about $16 million in suspicious outflows from wallets linked to CoinDCX.

Which assets were involved in the flagged transactions?

The outflows involved USDT, a dollar-pegged stablecoin, and Tron’s TRX token.

What was the largest transaction mentioned?

The largest transaction was 15,819,002 USDT, which was sent as part of the movement highlighted by on-chain observers.

What does CoinDCX say caused the issue?

CoinDCX says the activity involved old wallet addresses created in January 2025, compromised in July 2025, and later deprecated by the exchange.

Why did investigators challenge CoinDCX’s explanation?

ZachXBT said at least one address appeared to continue receiving deposits and interacting with CoinDCX’s current public hot wallet into April and May 2026.

Were users compensated for affected deposits?

CoinDCX said it credited every affected user and absorbed the operational losses tied to the temporary failure in its sweeping process.

Is trading still operating on CoinDCX?

CoinDCX said trading continues as usual and that customer assets are held in cold wallets.

Why do deprecated addresses matter for exchange security?

Deprecated addresses can still receive funds if users send assets to them, so exchanges must manage old infrastructure carefully after a security incident.