$16M Left CoinDCX Wallets. The Explanation Changed Within a Day. What Platforms Should Do.

Signal Spotlight · Exchange security and counterparty risk

What happened

According to crypto.news, ForkLog and Protos, about 15.99 million USDT and 5,783.81 TRX moved on the TRON network at around 23:35 (UTC+8) on 21 October from CoinDCX hot wallets and deposit addresses to a single address. The largest transfer was 15.82 million USDT. On-chain investigator Darcy of Salus flagged the movement publicly on 22 October. ForkLog and crypto.news report that the receiving address split the funds across several wallets, and some reached deposit addresses at large exchanges.

First response. CoinDCX co-founder and CEO Sumit Gupta denied a new breach, saying the flagged addresses were created in January 2025, were compromised in the July 2025 attack that cost about US$44 million, and appeared to be reused by attackers. CoinDCX's official account said user funds were safe and trading continued as normal.

Later response. Moneycontrol, via TradingView, and Protos report a further CoinDCX statement. In it, CoinDCX said the addresses were deprecated, users had kept depositing to them despite notices, and a sweeping process that moves deposits into secure wallets failed for a period. It described the result as "operational losses" that it absorbed, said affected users' deposits were credited to their accounts, and said customer assets remain in separate cold wallets. We did not find this statement in CoinDCX's own channels, so we are relying on those reports for its wording.

The dispute. ZachXBT said one of the addresses was used by a liquidity provider for about ten months after the 2025 incident and forwarded funds to CoinDCX's current public hot wallet as recently as May 2026. He alleged roughly US$15.8 million in user deposits was unaccounted for. Protos reports that Taylor Monahan said the laundering methods differ from last year's attack, which she suggested may point to different actors. Other commentators accused CoinDCX of lying. Those are allegations, not findings.

What is and is not established

The outflow is on-chain. The transfer amounts and timing come from blockchain data cited by several outlets. Whether the transfers were an attack, a sweep failure or something else rests on competing explanations.

Whether this was a hack is disputed. CoinDCX says it was not a hack of current wallets. Investigators question whether the old addresses were really unused. We cannot settle this from public data.

User impact is CoinDCX's statement. The claim that no user lost money rests on CoinDCX saying it credited affected users. We found no independent confirmation, and the figures for how many users were affected have not been published.

The link to the 2025 breach is partly explained. CoinDCX ties the addresses to the July 2025 compromise. One outlet, Whalesbook, says keys stolen then were used here. Other outlets do not say that, and CoinDCX has not said it either, so we treat it as unconfirmed.

No post-mortem has been published. We did not find a detailed timeline from first outflow to detection to fix. Protos reports CoinDCX had not responded to its email by publication.

We did not read Cointelegraph's original report. The core facts here come from crypto.news, ForkLog, Protos, Moneycontrol and Whalesbook, which broadly agree on the transfer and differ on the cause.

Why it matters

The useful point for operators is the sequence. External investigators spotted the outflow, the exchange denied a hack, and a different explanation followed within about a day. Anyone holding balances on CoinDCX during that window had to make decisions with changing information.

The second point is about legacy infrastructure. On CoinDCX's own account, deposits kept arriving at deprecated addresses and a sweep process failed. That is a control problem, not a story about a clever exploit. Whether it was a theft or a sweep failure, the same question applies to every platform that retires old deposit addresses: how do you know nothing is still landing there?