India’s premier digital asset exchange, CoinDCX, has firmly dismissed allegations that its active funds were breached, following disclosures by blockchain analysts regarding roughly $16 million in unusual outflows originating from addresses associated with the platform.
“The transfers cited in recent accusations involve legacy wallet addresses generated back in January 2025. These specific accounts were compromised during a security incident in July 2025 and have not been utilized by CoinDCX since that time. The activity currently being highlighted pertains strictly to these outdated endpoints and has no association whatsoever with CoinDCX,” a representative for the trading platform informed CoinDesk. “Our active central infrastructure and user endpoints remain entirely secure, and no platform assets residing in operational wallets have been compromised.”
The situation began when an X user known as Darcy pointed out a substantial withdrawal from CoinDCX’s operational hot wallet alongside multiple user deposit endpoints on Wednesday. The transfers amounted to roughly $16 million denominated in USDT, a fiat-pegged stablecoin, and the Tron blockchain’s TRX asset.
Every customer is assigned a dedicated deposit endpoint, which serves as a unique string for transferring digital assets. The trading platform subsequently executes regular sweeping procedures, gathering those inbound transfers into its primary core accounts so all capital resides under a unified management system. A portion of those funds flows into a hot wallet, an internet-linked repository utilized for standard daily withdrawals, while the remainder is directed to cold storage facilities kept entirely offline.
All of those funds were routed to a single Tron account, according to Darcy, with the largest individual transfer reaching 15,819,002 USDT. That destination account then distributed the capital across several separate wallets.
Darcy’s social media post classified the movement as a potential theft, sparking worries regarding a fresh security breach at the platform. CoinDCX previously experienced a security exploit in July 2025 resulting in losses of approximately $44 million.
CoinDCX Chief Executive Officer Sumit Gupta contested the assertions on X, indicating that the perpetrators from the July 2025 incident appear to be reusing the legacy wallet accounts and labeling the event a false alarm.
Stated differently, the official stance of CoinDCX is that the organization abandoned those specific endpoints following the breach and that the attackers are the ones continuing to operate them.
Prominent on-chain investigator ZachXBT disputed that assertion. He pointed out that at least one of those accounts, identified as TQKJQ, remained active.
“CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet,” he stated.
Put simply, he indicated that the endpoint continued gathering customer deposits and transferring them into CoinDCX’s active wallet during the spring. A liquidity provider is an entity that furnishes purchase and sale orders to a marketplace, whereas gas refers to the minor charge required to execute transactions on a blockchain network.
When questioned about whether that legacy endpoint was actually still operational rather than abandoned, CoinDesk was informed that the firm did indeed instruct its users after the July 2025 security event to refrain from transferring assets to such compromised locations. The organization currently designates these endpoints as deprecated or retired.
“Despite our previous warnings, certain individuals persisted in transferring assets to deprecated deposit endpoints instead of the updated ones,” the platform representative stated.
The organization explained that its sweeping mechanism is designed to capture such misdirected transfers, but that process experienced a temporary malfunction. CoinDCX stated that it reimbursed every impacted client. The company reiterated that client reserves remain secured in offline storage and that its active endpoints were untouched, allowing trading operations to proceed normally.
Originally published at https://www.coindesk.com/markets/2026/10/23/india-s-largest-exchange-denies-hack-after-blockchain-sleuths-pointed-to-usd16-million-in-suspicious-outflows.
