CoinDCX denies new breach after $16M in transfers flagged

CoinDCX denied suffering a new security breach after investigators flagged about $16 million in transfers from wallets linked to the Indian cryptocurrency exchange. CEO Sumit Gupta said the company was investigating the transactions and that no user funds would be lost.

CoinDCX said Thursday that the wallets were created in January 2025 and compromised during a $44 million hack in July 2025. The exchange said it stopped using the wallets after the hack and that customer wallets were separate from the affected account.

Blockchain investigator ZachXBT disputed that account. He said a CoinDCX deposit address linked to a liquidity provider remained active for 10 months after the July 2025 hack. The address allegedly continued sending user deposits to CoinDCX’s current public hot wallet and receiving funds to pay transaction fees.

“Yes, aware of that. We’re investigating it further, and will share an update soon,” Gupta wrote. “We assure that no user funds will be at loss.”

Darcy, co-founder of asset recovery platform FlashRescue, initially identified about $16 million in transfers from addresses labeled as belonging to CoinDCX. Darcy also said that two addresses listed in CoinDCX’s latest proof of reserves had sent funds to the flagged Tron address.

CoinDCX was drained of $44 million in July 2025. The exchange said at the time that customer wallets were not affected and that it would cover the loss from its treasury reserves. CoinDCX had not responded to a request for comment by publication.