Indian cryptocurrency exchange CoinDCX has denied allegations of a new security breach involving nearly $16 million in cryptocurrency transfers, although blockchain investigator ZachXBT has challenged the companys explanation of the suspicious wallet activity.
CoinDCX said in an October 22 statement that claims circulating on X were misleading because the transactions involved wallet addresses created in January 2025 and compromised during its July 2025 security incident.
The exchange maintained that customer funds remained safe and that the addresses identified in the latest allegations were no longer part of its active wallet infrastructure.
However, ZachXBT disputed the explanation, claiming that at least one of the addresses continued handling deposits and interacting with CoinDCXs current hot wallets several months after the previous breach.
The disagreement followed allegations from blockchain investigator Darcy, who flagged transactions involving approximately 15.99 million USDT and 5,783.81 TRX on the TRON network.
10 月 21 日 23:35:54（UTC+8），CoinDCX 疑似被盗取约1,599 万 USDT 和 5,783.81 TRX
CoinDCX 热钱包及多个充值地址，向 TRON 地址 TAg6SZ1HhgVVjUaKY1paQoFBUS2JFrg5bT 转入约 1,599 万 USDT 和 5,783.81 TRX
其中最大单笔为 15,819,002…
— Darcy 资产救援⛑️ (@DarcyAri) October 22, 2026
CoinDCX disputes claims of another $16 million hack
According to Darcy, the suspicious transactions occurred on October 21 at approximately 23:35 UTC+8, when funds from wallets identified as CoinDCX deposit addresses and hot wallets moved to a separate TRON address.
The investigator identified a transfer of 15,819,002 USDT as the largest individual transaction and claimed that the receiving address subsequently distributed the funds across multiple wallets.
Darcy alleged that some of the funds eventually reached deposit addresses associated with Binance, OKX, Gate and other cryptocurrency exchanges after passing through several intermediary addresses.
However, the investigators findings did not independently establish whether the transfers were unauthorized or whether the receiving wallets belonged to an attacker.
Responding to the allegations, CoinDCX co-founder and CEO Sumit Gupta rejected suggestions that the exchange had suffered another breach.
“CoinDCX wallets are not breached,” Gupta wrote, urging users not to spread rumors while the company examined the transactions.
Gupta explained that the addresses identified through Arkham Intelligence previously belonged to CoinDCX but had been compromised during the July 2025 attack.
Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don't spread rumours.
The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the… https://t.co/6hKfTtffHK
— Sumit Gupta (@smtgpt) October 22, 2026
According to the executive, the attackers appeared to be reusing those addresses, which he described as a possible false alarm.
He maintained that the exchange had checked its current operational and customer addresses and found no transfers from those wallets to the addresses involved in the allegations.
Gupta further pointed to CoinDCXs publicly available proof of reserves information and said the company would provide additional details as its investigation continued.
ZachXBT challenges CoinDCX over continued wallet activity
ZachXBT subsequently questioned the exchanges account, citing transactions involving a deposit address identified as TQKJQ on the TRON blockchain.
The investigator claimed that the address remained in use by a liquidity provider for approximately 10 months after the July 2025 incident, despite CoinDCX describing the associated wallets as compromised.
According to ZachXBT, the address continued receiving deposits and gas transfers as recently as April and May 2026, with funds moving to wallets publicly identified as CoinDCXs current hot wallets.
He argued that the transaction history contradicted the companys explanation that the addresses were simply abandoned wallets being reused by attackers.
ZachXBT further alleged that approximately $15.8 million in customer deposits had gone unaccounted for by the exchange.
CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet.
Meaning $15.8M in user deposits was unaccounted for by your team.
Why are Indian… pic.twitter.com/S8WYtGNIjz
— ZachXBT (@zachxbt) October 22, 2026
The screenshot accompanying his post showed a transfer of roughly 15.819 million USDT on October 21, alongside several smaller transactions involving USDT and TRX during May 2026.
However, the available screenshots do not independently establish ownership of every wallet, the purpose of the transactions, or whether the reported amount represents a confirmed customer loss.
CoinDCX had not publicly reconciled the specific transaction history cited by ZachXBT with its explanation at the time of reporting.
CoinDCX previously suffered a $44 million security breach
The dispute follows CoinDCXs July 2025 security breach, when attackers stole approximately $44 million from an internal liquidity account used by the exchange.
As crypto.news previously reported, the company attributed the incident to a sophisticated server compromise and maintained that customer assets held separately in cold storage were unaffected.
CoinDCX initially suspended certain services as a precaution but subsequently restored normal operations while investigating the incident with security specialists and Indian authorities.
The company said it would absorb the losses through its treasury and later announced a recovery bounty program offering up to 25% of recovered assets, capped at $11 million.
The exchange had previously established a customer protection fund in August 2024, initially allocating approximately $6 million and committing 2% of its brokerage income toward the fund.
The initiative followed the $230 million WazirX hack, which affected customer assets and prompted questions about how Indian cryptocurrency exchanges would handle losses arising from security incidents.
During the July 2025 breach, CoinDCX maintained that its internal operational wallets were separate from customer custody infrastructure, allowing the company to cover the stolen assets without passing the losses on to users.
In his latest response, Gupta said the team was continuing to investigate the disputed transactions and would release further information through CoinDCXs official communication channels.