What changed

CoinDCX’s defense against hack allegations hinges on a technical distinction: the exchange says the $16 million that moved out of wallets tied to it came from addresses it had already abandoned, not from its live infrastructure. That claim now rests on whether an exchange can actually “retire” a deposit address once customers know it, since at least one of those addresses kept accepting user funds and routing them into CoinDCX’s current hot wallet well into 2026, according to on-chain investigator ZachXBT.

The dispute matters because it’s not really about whether CoinDCX got hacked again. It’s about whether an exchange’s internal process for decommissioning compromised wallets actually works once it’s been told to stop.

Key Takeaways

  • CoinDCX denies its active wallets were compromised after an on-chain researcher flagged roughly $16 million in outgoing USDT and TRX from addresses linked to the exchange.
  • CoinDCX says the addresses involved were created in January 2025, compromised in a July 2025 hack that cost it about $44 million, and have not been used by the exchange since.
  • Investigator ZachXBT disputes that the addresses were dormant, saying one labeled TQKJQ kept sweeping user deposits into CoinDCX’s current hot wallet as recently as April and May 2026.
  • CoinDCX acknowledges a separate problem: its process for sweeping deposits sent to deprecated addresses temporarily failed, and it says it has credited every affected user.

What triggered the alarm

The report started Wednesday when an X user named Darcy, identified by TokenPost as the CMO of Salus, flagged a large outflow from CoinDCX’s hot wallet and several of its deposit addresses, according to CoinDesk. The flagged activity totaled about $16 million in USDT, a dollar-pegged stablecoin, and TRX, the Tron network’s native token, with the single largest transaction moving 15,819,002 USDT.

All of it funneled into one Tron address before being split across several other wallets, Darcy said. Darcy also pointed to a hot wallet that kept distributing small amounts of TRX, 15 at a time, to cover network gas fees around the time of the activity, and alleged that some of the funds reached Binance, OKX and Gate, along with addresses Darcy associated with Huione and Xinbi, according to TokenPost. Darcy’s framing was blunt: if CoinDCX wasn’t hacked, the alternative explanation is that the exchange moved user assets itself.

CoinDCX’s explanation

CoinDCX’s position is that the flagged wallets belong to a past incident, not a current one. “The transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since,” a spokesperson told CoinDesk. “Current CoinDCX central and user addresses have not been impacted, and no CoinDCX funds from active wallets have been compromised.”

CEO Sumit Gupta pushed back on X directly, arguing that the same actors behind the July 2025 breach, in which CoinDCX lost about $44 million, are simply reusing the old addresses, and calling the new report a false alarm, per CoinDesk. The exchange’s account amounts to this: it abandoned those wallets after the 2025 hack, and whoever drained them this week is working from stolen access, not new access.

The investigator’s pushback

ZachXBT challenged that timeline directly. He said at least one address, labeled TQKJQ, “was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet,” according to CoinDesk. An LP, or liquidity provider, is a firm that supplies buy and sell orders to an exchange; gas is the fee paid to move tokens on a blockchain. The claim, if accurate, means the address wasn’t simply sitting dormant since mid-2025. It was still funneling deposits into CoinDCX’s live wallet system this spring, months after the exchange says it stopped using it.

CoinDCX’s response to that specific point shifted the explanation slightly. The exchange said it had told users after the July 2025 hack not to send funds to the compromised addresses and now labels them “deprecated.” “Despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones,” the spokesperson said. Finst and Cryptonews both carried the same core denial, with Finst framing the episode as a case study in the gap between an attack on retired addresses and a breach of an exchange’s live wallet system.

The sweep failure CoinDCX admits to

CoinDCX’s own account concedes an operational gap even as it denies a hack. The exchange said its process for sweeping deposits, meaning moving money sent to user addresses into the wallets it actually controls, is supposed to catch funds sent to deprecated addresses too, but that this process failed for a period. CoinDCX said it has since credited every user whose deposit was affected, absorbing the resulting losses itself, per CoinDesk. The exchange maintains that customer assets sit in cold, offline wallets, that its current addresses were not touched, and that trading has continued without interruption.

What to watch

The gap between CoinDCX’s claim that the addresses were abandoned and ZachXBT’s claim that one was active into 2026 remains unresolved in the brief’s coverage. Whether CoinDCX publishes technical detail on how the sweep failure occurred, and for how long, would settle whether this was a lingering effect of the July 2025 breach or a separate operational lapse.

Sources