A fresh crypto controversy has landed on the doorstep of India’s largest exchange this week. CoinDCX, one of the country’s biggest cryptocurrency platforms, has firmly denied claims that it suffered a new security breach, after blockchain investigators flagged nearly $16 million in suspicious transfers linked to its wallets on October 21. The exchange says the movement of funds is old news, tied to a 2025 incident. But investigators, including well-known on-chain sleuth ZachXBT, are not buying the explanation, and the numbers tell a tangled story.
The $16 million transfers that started it all
The alarm was raised by Darcy, co-founder of the asset recovery platform FlashRescue, who spotted unusual activity on the TRON blockchain on October 21. According to his findings, wallets labelled as CoinDCX deposit and hot wallets moved roughly 15.99 million USDT (Tether) and 5,783.81 TRX to a single new TRON address in the early hours of the morning.
The largest single transaction was worth 15,819,002 USDT. The receiving address then split the funds across a chain of intermediary wallets, and some of the money eventually landed in deposit accounts on other exchanges, including Binance, OKX and Gate. That pattern, investigators noted, looks a lot like someone quietly dispersing funds rather than routine treasury management.
CoinDCX says: no new hack, just old wallets
CoinDCX responded on October 22 with a clear denial. The exchange said the wallet addresses in question were created in January 2025 and compromised during its July 2025 security incident, after which they were retired from active use. Any claims of a fresh hack, the company said, are misleading.
So why did money move at all? CoinDCX’s explanation is that some customers kept sending crypto to those dead addresses even after the breach, and its process for sweeping those stranded deposits into current wallets broke down for a period. That breakdown caused operational losses, which the exchange says it absorbed from its own treasury, crediting every affected deposit to customers. Cold storage and current operating wallets, it added, were never touched.
ZachXBT pokes holes in the timeline
This is where the story gets interesting. ZachXBT, one of the crypto world’s most respected independent investigators, directly challenged CoinDCX’s version of events. He pointed out that at least one of the flagged addresses continued accepting deposits and interacting with CoinDCX’s current hot wallets several months after the July 2025 breach, with activity visible as late as April and May 2026.
He further alleged that roughly $15.8 million in customer deposits had gone unaccounted for. Darcy added another uncomfortable detail: two addresses listed in CoinDCX’s own latest proof of reserves had transferred funds to the flagged address.
CoinDCX CEO Sumit Gupta responded publicly, saying the team was investigating the latest claims and would share an update soon. “We assure that no user funds will be at loss,” he said.
Why Indian crypto users are watching closely
For Indian investors, this episode lands at an uncomfortable moment. The domestic crypto industry is still recovering from the July 2024 WazirX hack, which drained over $230 million and left lakhs of users locked out of their funds for months. CoinDCX itself was hit in July 2025, when an internal operational account was compromised to the tune of around $44 million, an incident the company blamed on sophisticated attackers and said it would cover from treasury reserves.
- Customer funds: CoinDCX insists all user holdings are kept in separate cold wallets and remain safe, and that it has credited every affected deposit.
- The timeline dispute: ZachXBT’s on-chain evidence suggests the flagged addresses were not as “retired” as claimed, which is the core of the disagreement.
- No independent confirmation: Crucially, no security breach or customer loss has been independently confirmed. Both sides are interpreting the same wallet data differently.
- The regulatory backdrop: India taxes crypto gains at 30% with a 1% TDS, yet offers no investor protection framework, so exchange trust is everything.
What happens next
The dispute is now a waiting game. CoinDCX has promised a fuller update after its internal investigation, and the on-chain community will no doubt keep auditing every transaction. If the exchange can show that all flagged addresses were indeed retired and that customers were credited, the story may fade. If ZachXBT’s timeline holds, expect harder questions about how the exchange manages and retires deposit addresses.
Either way, the episode is a reminder of a lesson Indian crypto users have learned the hard way: when money moves on the blockchain, everyone can see it, and the exchange is not the only one who gets to tell the story.
FAQs
Did CoinDCX get hacked again in October 2026?
CoinDCX says no. The exchange claims the flagged $16 million in transfers involve wallets retired after its July 2025 breach. No new breach or customer loss has been independently confirmed.
How much crypto was involved?
Investigators flagged about 15.99 million USDT and 5,783.81 TRX, worth roughly $16 million (about Rs 151 crore), moved on the TRON network on October 21.
Who is disputing CoinDCX’s explanation?
Blockchain investigator ZachXBT and FlashRescue co-founder Darcy. ZachXBT says at least one flagged address was still active months after the July 2025 breach and that about $15.8 million in deposits appear unaccounted for.
Are CoinDCX customer funds safe?
The exchange says yes: customer holdings sit in separate cold wallets, and it absorbed any operational losses itself. CEO Sumit Gupta has assured users that no user funds will be at loss.
What was CoinDCX’s July 2025 breach?
An internal operational account was compromised in an incident with roughly $44 million in exposure. The company said customer wallets were separate from the affected account and covered the loss from its treasury.
Stay cautious, verify claims against official statements, and never invest more than you can afford to lose in crypto markets.
