India's largest exchange denies hack after sleuths pointed to $16 million in suspicious outflows

India's largest crypto exchange, CoinDCX, has denied that its active wallets were compromised, after blockchain sleuths flagged about $16 million in suspicious outflows from wallets linked to the exchange.

“The transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since. The activity now being reported relates to these old addresses and does not have any connection with CoinDCX,” the exchange’s spokesperson told CoinDesk. “Current CoinDCX central and user addresses have not been impacted, and no CoinDCX funds from active wallets have been compromised.”

It started when an X user named Darcy highlighted a large outflow from CoinDCX's hot wallet and several of its deposit addresses on Wednesday. It totaled about $16 million in USDT, a dollar-pegged stablecoin, and Tron’x TRX token.

Every user gets a personal deposit address, a unique string of characters to send crypto to. The exchange then regularly "sweeps" those deposits, meaning it moves them into its own main wallets so everything sits in one place it controls. Some of that money goes to a hot wallet, an internet-connected place used for everyday withdrawals. The rest goes to cold wallets, which are kept offline.

All of it was sent to a single Tron address, Darcy said, with the largest transaction at 15,819,002 USDT. That address then split the money across several different wallets.

Darcy's post flagged the outflow as a suspected theft, raising fears of a fresh hack at the exchange. CoinDCX was exploited before, in July 2025, for about $44 million.

CoinDCX’s CEO Sumit Gupta pushed back on X, saying the July 2025 hackers seem to be reusing the old wallet addresses and calling it a false alarm.

In other words, CoinDCX’s position is that the exchange abandoned those addresses after the hack and that the hackers are the ones still using them.

ZachXBT, a well-known on-chain investigator, challenged that claim. He said at least one of those addresses, labeled TQKJQ was still in use.

"CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet,” he said.

In plain terms, he said the address kept collecting customer deposits and passing them into CoinDCX's current wallet this spring. An LP is a liquidity provider, a firm that supplies buy and sell orders to an exchange. Gas is the small fee paid to move tokens on a blockchain.

When asked whether that old address wasn’t abandoned and was still handling money, CoinDesk said that it did tell its users following the July 2025 hack not to deposit funds to such compromised addresses. The exchange now calls these addresses "deprecated," or retired.

"Despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones," the spokesperson said.

The exchange said sweeping is meant to catch such deposits, but that it failed for a period. CoinDCX said it credited every affected user. It said customer assets sit in cold wallets and that its current addresses were not hit. Trading continues as usual.