Indian cryptocurrency exchange CoinDCX has denied a new security breach following scrutiny over approximately $16 million in suspicious transfers linked to old wallets. The exchange stated on Thursday that the flagged transactions involved addresses created in January 2025, which were compromised during a July 2025 hack and have not been used by the platform since. However, blockchain investigator ZachXBT challenged this narrative, alleging that a CoinDCX deposit address remained active with a liquidity provider for ten months after the initial incident. According to ZachXBT, this address continued to transfer user deposits to CoinDCX’s current public hot wallet and receive funds for transaction fees.
CoinDCX CEO Sumit Gupta acknowledged awareness of the situation, stating that the company is investigating further and will provide an update soon. He assured users that no customer funds would be lost. Earlier, Darcy, co-founder of asset recovery platform FlashRescue, identified the $16 million in transfers from addresses labeled as belonging to CoinDCX. Darcy also claimed that two addresses listed in the exchange’s latest proof of reserves had transferred funds to a flagged Tron address. This development follows a previous incident in July 2025 where CoinDCX was drained of $44 million. At that time, the exchange asserted that customer wallets were separate from the affected account and promised to cover losses using its own treasury reserves.
The discrepancy between CoinDCX’s assertion that compromised wallets are inactive and ZachXBT’s evidence of ongoing usage highlights critical gaps in operational transparency and post-incident management. If the exchange continued routing user deposits through addresses previously deemed compromised, it suggests either a failure in isolating affected infrastructure or a lack of clear communication regarding wallet lifecycle changes. Such inconsistencies can erode trust, particularly when proof-of-reserves data appears to contradict independent on-chain analysis regarding fund movements.
Regulatory scrutiny in India may intensify if these allegations prove accurate, as exchanges are expected to maintain strict segregation of assets and secure custody practices. The reliance on treasury reserves to cover past hacks raises questions about the sustainability of such models under repeated security failures. Investors and users should monitor whether CoinDCX provides verifiable technical explanations for the continued activity on flagged addresses, as vague assurances without concrete forensic details may signal deeper systemic vulnerabilities in their security protocols.
