CoinDCX Denies New $16M Hack, Says It Absorbed Transfer Losses

On Oct. 22, CoinDCX stated that it has reimbursed all impacted user deposits and absorbed the resulting losses after a wallet-transfer procedure malfunctioned, while firmly refuting reports of a fresh $16 million hack in the latest development of the CoinDCX security saga. The Indian cryptocurrency exchange maintained that the suspicious transactions involved previously breached addresses and that its operational active wallets remained completely secure.

This acknowledgment followed pushback from investigators regarding CoinDCX’s initial claim that the flagged addresses had been permanently abandoned following a security breach in July 2025.

CoinDCX Acknowledges Losses From Failed Deposit Transfers

CoinDCX explained that its automated mechanism for sweeping deposits away from compromised addresses stopped working properly for a period of time, forcing the company to shoulder the financial shortfall. In its Oct. 22 release, the firm noted: “This failure led to some operational losses, which were absorbed by CoinDCX.”

The platform admitted to this breakdown after independent analysts questioned its explanation surrounding roughly $16 million in suspicious asset movements. The exchange has elected not to reveal the exact monetary figure of these operational losses.

CoinDCX Says Affected Depositors Have Been Credited

CoinDCX pointed out that despite repeated warnings issued after the July 2025 security event, certain customers continued transferring digital assets to legacy deposit addresses. The platform’s standard protocol is to sweep those incoming funds into protected wallets to correctly credit the users, but that specific workflow broke down.

Every impacted deposit has successfully been credited back to the appropriate user balance, according to CoinDCX. Furthermore, the company asserted that customer funds stay safely isolated within segregated cold storage, ensuring no assets stored in its central infrastructure or active user wallets were compromised.

CoinDCX continues to advise all users to strictly utilize the most current deposit addresses instead of any endpoints tied to the earlier breach.

Investigators Challenge CoinDCX’s Abandoned-Wallet Account After Hack

Darcy, co-founder of the asset recovery platform FlashRescue, originally pointed out approximately $16 million in TRX and USDT transfers as potential theft. According to CoinDesk, Darcy reported that these funds pooled into a single Tron address prior to being distributed across various other wallets, with the largest single transfer reaching nearly 15.8 million USDT.

Initially, CoinDCX claimed the targeted addresses were generated back in January 2025, compromised that same July, and left completely untouched by the exchange ever since. CEO Sumit Gupta put forward the theory that the original hackers were simply repurposing those same vectors.

However, blockchain sleuth ZachXBT challenged this timeline. He pointed out that a specific deposit address was actively utilized by a liquidity provider for ten months following the July incident, continuously funneling user deposits to the current public CoinDCX hot wallet and even receiving transaction-fee support as recently as April and May 2026.

CoinDCX Promises Further Investigation

In reply to ZachXBT’s findings, Gupta stated that CoinDCX is diving deeper into the matter and will release a follow-up statement soon. Any upcoming explanation will need to directly address the broken transfer mechanism alongside the investigators’ evidence regarding ongoing activity tied to the legacy addresses.

This controversy unfolds in the shadow of a $44 million security breach experienced by CoinDCX in July 2025. During that previous event, the organization noted that customer balances were kept apart from the targeted accounts and that the deficit would be paid off using internal treasury reserves.

FAQ

When were the disputed wallet addresses created and compromised?

CoinDCX dates their creation to January 2025 and their compromise to July 2025. The exchange describes them as retired addresses affected by the earlier incident.

What does CoinDCX’s deposit-sweeping process do?

It moves deposits sent to old addresses into secure wallets so CoinDCX can account for them. The company said a failure in this process caused losses that it absorbed.

Which address did ZachXBT cite as evidence of continued use?

He cited a CoinDCX deposit address that he said a liquidity provider continued using after the July 2025 incident. His challenge focused on transfers to the exchange’s current public hot wallet and transaction-fee funding in April and May 2026.

How much did CoinDCX lose in the July 2025 hack?

The earlier hack cost CoinDCX about $44 million. Its response at the time was to cover that loss from treasury reserves while maintaining that customer wallets were separate.

Did CoinDCX’s trading continue during the wallet controversy?

The exchange said trading continued as usual. It also assured users that its current central and user addresses were unaffected by the flagged activity.

This article is for information only and is not financial advice.

Frequently Asked Questions

Did CoinDCX experience a new $16 million hack?

No, CoinDCX denied a new hack, explaining instead that operational losses stemmed from a failed wallet-transfer process involving older, previously compromised addresses.

Were any users left out of pocket?

No, CoinDCX confirmed that all affected user deposits have been fully credited to the respective accounts.

What did blockchain investigators dispute?

Investigators like ZachXBT disputed CoinDCX’s claim that the flagged addresses were completely abandoned after July 2025, pointing to evidence of ongoing transactions and liquidity provider usage well into 2026.