Indian cryptocurrency exchange CoinDCX denied a new security breach after analysts flagged suspicious transfers, but investigators questioned its claim that it stopped using the wallets after a July 2025 hack.
The flagged transactions involved old wallets created in January 2025, which were “compromised in July 2025” and have not been used by the exchange since, CoinDCX said Thursday on X.
Blockchain investigator ZachXBT challenged that account, saying a CoinDCX deposit address remained in use by a liquidity provider for 10 months after the July 2025 incident. He said the address continued transferring user deposits to CoinDCXs current public hot wallet and receiving funds to cover transaction fees.
“Yes, aware of that. Were investigating it further, and will share an update soon,” responded Sumit Gupta, CEO of CoinDCX. “We assure that no user funds will be at loss.”
Darcy, co-founder of asset recovery platform FlashRescue, earlier on Thursday flagged about $16 million in transfers from addresses labeled as belonging to CoinDCX.
Darcy also claimed that two addresses listed in CoinDCXs latest proof of reserves had transferred funds to the flagged Tron address.
CoinDCX was drained for $44 million in July last year. The exchange said at the time that customer wallets were separate from the affected account and that it would cover the loss from its own treasury reserves.
CoinDCX did not respond to Cointelegraphs inquiry by publication.