CoinDCX rejects hack claims after reported $16 million USDT transfers
In brief
- CoinDCX denied links to reported transfers of about 16 million USDT and 5,783 TRX.
- CoinDCX said the wallets were created in January 2025 and compromised in July 2025.
- Salus executive Darcy reported funds flowing to Binance, OKX and Gate deposit addresses.
- CoinDCX said user funds are safe and trading continues as usual.
What CoinDCX said
CoinDCX said the transactions involved previously compromised wallet addresses unrelated to its current operations. Those addresses were created in January 2025 and compromised in July 2025, according to the exchange, which added that it hasn't used them since.
"Claims circulating on X regarding certain wallet addresses and transactions are misleading."
The company denied any connection between the reported activity and its operations. It also said users' funds are safe (and that trading and investing on the platform continued as usual).
What the transfer report showed
The transfer details come from Darcy, an executive at blockchain security firm Salus, not from CoinDCX. According to Darcy, the activity happened at 23:35:54 UTC+8, when addresses identified as the exchange's hot wallet and multiple deposit addresses sent the assets to a single TRON address.
From there, the receiving address split the funds and moved them through multiple wallets, the transaction report said. Some of those flows reached deposit addresses associated with Binance, OKX, Gate and other exchanges.
So the headline figures (about 16 million USDT plus 5,783 TRX) trace back to Darcy's report. CoinDCX hasn't confirmed them as its own funds.
Its answer is that those addresses stopped being working wallets for the exchange back in July 2025.
The July 2025 backdrop
That July date matters. CoinDCX itself disclosed a security breach that month, losing approximately $44 million in a July 2025 hack that targeted an internal hot wallet used to provide liquidity on a partner exchange.
The exchange's statement this week points back to that period when it explains where the flagged addresses came from. It's a clear position: old wallets, created in January 2025 and compromised that July, with no use by CoinDCX since, and customer funds that it says remain safe.
