CoinDCX denies new hack after sleuths flag $16 million outflow from linked wallets
In brief
- Darcy, an X user, flagged about $16 million in USDT and TRX leaving CoinDCX-linked wallets.
- CoinDCX said the addresses were created in January 2025 and compromised in July 2025.
- CEO Sumit Gupta called reports a false alarm, saying July 2025 hackers appear to reuse old addresses.
- ZachXBT said deposit address TQKJQ still swept funds to CoinDCX's hot wallet in April and May 2026.
What the sleuths flagged
It started on Wednesday, when an X user named Darcy highlighted a large outflow from CoinDCX's hot wallet and several of its deposit addresses. The outflow totaled about $16 million in USDT and Tron's TRX token, according to Darcy's post as reported by CoinDesk. Darcy said all of it went to a single Tron address (the largest transaction was 15,819,002 USDT), and that address then split the funds across several different wallets.
Darcy's post flagged it as a suspected theft. That raised fears of a new hack at an exchange that's been through one before, since CoinDCX was exploited for about $44 million in July 2025.
CoinDCX's account
The spokesperson said current central and user addresses weren't affected.
"Current CoinDCX central and user addresses have not been impacted, and no CoinDCX funds from active wallets have been compromised."
CEO Sumit Gupta also pushed back on X. He said the July 2025 hackers appear to be reusing the old wallet addresses, and he called the reports a false alarm. CoinDCX said it told users after that hack not to deposit to the compromised addresses, which it now calls deprecated (retired). Some users kept depositing to them anyway, despite past notifications, the spokesperson said.
Exchanges regularly sweep deposit addresses into main wallets, sending some funds to an internet-connected hot wallet and the rest to offline cold wallets. CoinDCX said its sweeping process is meant to catch deposits like these but failed for a period. The exchange said it credited every affected user, that customer assets are held in cold wallets, and that trading continued as usual.
ZachXBT's challenge
On-chain investigator ZachXBT disputed that account. He said at least one of the addresses, labeled TQKJQ, was still in use. According to ZachXBT, a liquidity provider used that deposit address for 10 months after the July 2025 incident, and it swept user deposits to CoinDCX's current public hot wallet as recently as April and May 2026.
On that point, CoinDCX's account and ZachXBT's don't line up.
