Indian cryptocurrency exchange CoinDCX denied allegations of a new round of security vulnerabilities involving nearly $16 million in cryptocurrency transfers, but blockchain investigator ZachXBT questioned the company's explanations regarding suspicious wallet activities.

• CoinDCX denies a new cryptocurrency hacking incident worth $15.8 million and insists that customer funds are still safe.
• Blockchain investigator ZachXBT questions the exchange's explanation, stating that after an intrusion in July 2025, affected deposit addresses continued to process funds.
• This dispute stems from allegations regarding suspicious transfers between USDT and TRX, but there are currently no independently confirmed new security vulnerabilities or customer losses.
• CoinDCX CEO Sumit Gupta stated that these addresses were compromised during last year's hacking incident, and the exchange is investigating the latest claims.

In a statement on October 22, CoinDCX stated that the claims circulating on platform X are misleading, as the transactions in question involve wallet addresses that were created in January 2025 and were compromised during a security incident in July 2025.

The exchange insists that customer funds are still safe, and the addresses mentioned in the latest allegations no longer form part of its active wallet infrastructure.

However, ZachXBT raised objections to this explanation, stating that at least one address continued to process deposits for several months after the previous vulnerability occurred and interacted with CoinDCX's current hot wallet.

This controversy stems from accusations made by another blockchain investigator, Darcy. Darcy pointed out that there were transactions on the TRON network involving approximately $15.99 million in USDT and 5,783.81 TRX.

CoinDCX Denies Another $16 Million Hacker Attack

According to Darcy, the suspicious transaction occurred around 23:35 on October 21st (UTC +8), when funds from a deposit address identified as CoinDCX and a hot wallet were transferred to a separate TRON address.

The investigator pointed out that one transfer of $1,581,902 USDT was the largest individual transaction, and stated that the receiving address subsequently dispersed the funds to multiple wallets.

Darcy also mentioned that some of the funds, after passing through multiple intermediate addresses, ultimately flowed to deposit addresses associated with Binance, OKX, Gate, and other cryptocurrency exchanges.

However, these survey results do not independently prove whether these transfers were unauthorized, nor do they prove that the receiving wallets belong to the attackers.

In response to these allegations, CoinDCX, co-founder and CEO Sumit Gupta, denied that the exchange has been invaded again.

Gupta wrote: 'The CoinDCX wallet has not been compromised.' He urged users not to spread rumors during the period when the company is verifying these transactions.

Gupta explained that these addresses, identified through Arkham Intelligence, indeed belonged to CoinDCX before, but they were compromised during the attack in July 2025.

This executive stated that it appears the attackers are reusing these addresses, and he described this as a possible false positive.

He insists that the exchange has checked the current operating addresses and customer addresses and has not found any transfers from these wallets to the addresses involved in the allegations.

Gupta also mentioned the publicly accessible reserve certification information of CoinDCX, and stated that the company will provide more details as the investigation progresses.

ZachXBT questions CoinDCX's claim about continuous wallet activities

Subsequently, ZachXBT used a deposit address named TQKJQ on the TRON blockchain as an example to question the claims of the exchange.

According to this investigator, although CoinDCX described the relevant wallet as having been compromised, the address was still used by a liquidity provider for about 10 months after the incident in July 2025.

According to ZachXBT, this address was still receiving deposits and Gas transfers until April and May 2026, with the funds flowing into a wallet that has been publicly identified as CoinDCX's current hot wallet.

He believes that these transaction histories contradict the company's explanation that "these addresses are merely abandoned wallets that have been reutilized by attackers."

ZachXBT also indicates that approximately $15.8 million in customer deposits remain unexplained on the exchange's books.

The screenshots he released show that on October 21st, there was a transfer of approximately $15.819 million USDT. In addition, in May 2026, there were several small transactions involving USDT and TRX.

However, the existing screenshots do not independently prove the ownership of each wallet, the purpose of these transactions, or whether the reported amounts constitute confirmed customer losses.

As of the time of publication, CoinDCX has not yet made a public response to the discrepancies between the specific transaction history listed in ZachXBT and its explanations.

CoinDCX previously encountered a security vulnerability worth 44 million US dollars

This controversy occurred after the security vulnerability in CoinDCX in July 2025, when attackers stole approximately $44 million from an internal liquidity account used by the exchange.

According to previous reports by crypto.news, the company attributed this incident to a complex server intrusion and claimed that customer assets stored separately in cold wallets were not affected.

CoinDCX initially suspended some services out of caution, but later resumed normal operations while investigating the incident with security experts and Indian authorities.

The company stated that it would bear the losses with its own funds, and later announced a reward recovery plan that could result in the recovery of up to 25% of the assets, with a cap of 11 million US dollars.

The exchange previously established a customer protection fund in August 2024, initially allocating about 6 million US dollars, and committed to investing 2% of its brokerage income into this fund.

This measure comes after WazirX suffered a hacker attack worth $230 million; the incident affected customer assets and raised questions from the outside world about how Indian cryptocurrency exchanges handle losses from security incidents.

In the vulnerability incident in July 2025, CoinDCX insisted that its internal operational wallet was independent from the customer-hosted infrastructure, therefore the company was able to bear the cost of the stolen assets on its own and did not pass on the losses to users.

In the latest response, Gupta stated that the team is still continuing to investigate these controversial transactions and will release more information through the official communication channels of CoinDCX.