CoinDCX Denies Second Hack as Blockchain Investigators Allege $16 Million Theft

India’s cryptocurrency exchange CoinDCX is facing questions over the movement of nearly $16 million in cryptocurrency from wallets associated with the platform. Blockchain investigators flagged the transfers on October 21, 2026, prompting concerns that the exchange may have suffered another security incident following its approximately $44 million breach in July 2025.

CoinDCX has denied that its current wallet infrastructure was hacked. The company initially said the flagged addresses had been compromised during the previous incident and were no longer in use. It subsequently acknowledged that its process for sweeping deposits sent to deprecated addresses had failed for a period, resulting in operational losses that it said it had absorbed. Blockchain investigators have challenged the exchange’s explanation, leaving questions about the wallet activity and the handling of customer deposits.

Key Takeaways

• Nearly $16 million flagged: Investigators reported approximately 15.99 million USDT and 5,783.81 TRX moving from wallets linked to CoinDCX.
• CoinDCX denies a new hack: The exchange says the addresses were associated with its July 2025 security incident and were no longer intended for use.
• Operational losses acknowledged: CoinDCX said its process for sweeping deposits sent to deprecated addresses failed for a period.
• Investigators dispute the explanation: ZachXBT and Bitquery cited blockchain transactions that they say indicate continued activity involving the addresses.
• Customer funds disputed: CoinDCX maintains that user funds remain safe and affected deposits were credited, but investigators have questioned the handling of the funds.
• Previous breach: CoinDCX lost approximately $44 million in a July 2025 incident involving an internal liquidity wallet.

What Happened to the $16 Million in Cryptocurrency?

The latest controversy began after blockchain investigators identified large transfers involving addresses associated with CoinDCX on the TRON network.

According to reporting by Moneycontrol, investigator DarcyAri flagged the movement of approximately 15.99 million USDT and 5,783.81 TRX. The assets were transferred through multiple transactions and wallets, with some funds subsequently reaching addresses associated with cryptocurrency exchanges including Binance, OKX and Gate.

Bitquery’s investigation published on October 22 provided additional transaction-level analysis. It attributed the outflows to 40 CoinDCX-linked wallets and reported that approximately $15.82 million of the total originated from a single address.

The distinction between blockchain activity and a confirmed security breach is important. Public blockchain records can show which addresses transferred cryptocurrency and when, but they do not independently establish who controlled the private keys, whether a transfer was authorized or how the exchange accounted for the affected deposits internally.

CoinDCX has disputed the claim that the activity represents a fresh breach of its current wallet infrastructure.

Why CoinDCX Says It Was Not a New Hack

CoinDCX co-founder and CEO Sumit Gupta initially rejected the allegations, saying the addresses identified by investigators were associated with the exchange before its July 2025 security incident.

The company said the addresses had been compromised during that earlier attack and were subsequently deprecated. According to CoinDCX, the latest transfers involved those old addresses rather than its active wallet infrastructure.

The exchange also warned users against depositing cryptocurrency into deprecated addresses. Such addresses may remain visible on a blockchain even after an exchange stops supporting them, which can create risks for customers who reuse old deposit details.

However, the explanation prompted further scrutiny when investigators questioned whether the addresses had truly been inactive.

In its subsequent clarification, CoinDCX acknowledged that some users continued to send cryptocurrency to the deprecated addresses despite earlier warnings. The exchange said its operational process normally swept such deposits so they could be accounted for and secured, but that the process failed for a particular period.

CoinDCX described the resulting impact as operational losses that it had absorbed. It also said affected customer deposits had been credited to users’ accounts and maintained that customer assets remained safe.

What Blockchain Investigators Found

Blockchain investigator ZachXBT challenged CoinDCX’s explanation, pointing to activity involving an address identified as a CoinDCX deposit address. He alleged that the address continued handling deposits and interacting with wallets identified as the exchange’s current hot wallets months after the July 2025 incident.

Bitquery’s analysis also challenged the assertion that the flagged addresses had not been used after the earlier breach. Its report described transactions involving the addresses before and after July 2025 and traced transfers made shortly before the October 2026 outflow.

The investigation reported that approximately $9.63 million had reached addresses associated with OKX, Binance and Gate within roughly 18 hours of the main transfers. It also identified cryptocurrency that remained in wallets on the receiving side at the time of its analysis.

These findings add detail to the public blockchain record, but they should be interpreted carefully. Wallet labels are based on attribution and transaction patterns, and the blockchain does not reveal every internal accounting entry or the identity of every wallet controller.

The central unresolved question is whether the October transfers were entirely unrelated to CoinDCX’s active systems, as the company initially suggested, or whether the exchange continued using addresses that it described as deprecated.

CoinDCX’s Earlier $44 Million Security Breach

The latest allegations carry additional significance because CoinDCX suffered a major security incident in July 2025.

The company reported that attackers stole approximately $44 million from an internal liquidity account used for exchange operations. CoinDCX said the affected account was separate from customer custody infrastructure and maintained that customer funds were not affected by the original breach.

The incident raised questions about the security of exchange infrastructure, the separation of operational and customer assets, and the procedures used to respond to compromised wallets.

CoinDCX said it would absorb the losses rather than pass them on to customers. The exchange also pursued recovery efforts and worked with security specialists as part of its response.

The October 2026 controversy is different in its publicly reported details. The latest dispute centres on previously compromised addresses, subsequent deposits and the process for sweeping funds sent to those addresses. Whether the new outflows should be classified as another hack remains disputed.

How the Incident Could Affect Cryptocurrency Exchange Security

The controversy highlights a problem that cryptocurrency exchanges must manage even after a security breach has been contained: old wallet addresses can remain active on public blockchains long after an exchange has stopped recommending them.

Customers may continue using saved deposit details, while automated systems may still need to identify and account for incoming funds. If the exchange’s controls fail, cryptocurrency sent to an unsupported address may be exposed to additional risks.

Exchanges can reduce these risks through clear deposit warnings, address-management controls, automated monitoring and strict reconciliation procedures. They can also improve customer communication by explaining whether a deposit address is active, deprecated or compromised.

For users, checking the latest deposit address before transferring cryptocurrency is an important precaution. Cryptocurrency transfers are generally difficult or impossible to reverse once confirmed, and an exchange may not be able to recover funds sent to an unsupported address.

The incident also demonstrates why proof-of-reserves disclosures and wallet monitoring serve different purposes. Proof of reserves can provide information about assets held by an exchange, but it does not by itself explain every historical transaction, establish that all operational processes are functioning correctly or settle disputes about a particular outflow.

What Customers Should Know

CoinDCX has said that customer funds remain safe and that affected deposits were credited to users. Investigators, meanwhile, have raised questions about how the flagged deposits were handled and whether the exchange’s public explanation matches the transaction history.

Customers should distinguish between these competing statements and verified account-level information. The reported wallet outflow does not, on its own, prove that every CoinDCX customer has suffered a loss. Equally, a public assurance about customer funds does not resolve every question raised by the transaction analysis.

Users concerned about their accounts should consult official CoinDCX communications, review their own transaction histories and avoid sending cryptocurrency to old or unverified deposit addresses. They should also be cautious about unsolicited messages from people claiming they can recover stolen cryptocurrency in exchange for an upfront fee.

The Bigger Picture

The CoinDCX dispute underscores how difficult it can be to establish what happened during a cryptocurrency incident. Blockchain records provide a transparent history of transfers, but interpreting that history requires careful attribution and an understanding of how exchanges manage wallets, liquidity and customer deposits.

The outcome will depend on whether CoinDCX provides further evidence that reconciles the disputed transactions with its explanation. Clear communication about deprecated addresses, the failed sweeping process and the accounting treatment of the affected deposits would help clarify the incident for customers and the wider cryptocurrency market.

FAQs

1. Was CoinDCX hacked again in October 2026?

CoinDCX denied that its current wallet infrastructure was breached. Investigators reported approximately $16 million in cryptocurrency moving from wallets associated with the exchange and questioned its explanation. The classification of the incident as a new hack remains disputed.

2. How much cryptocurrency was reportedly stolen?

Investigators flagged approximately 15.99 million USDT and 5,783.81 TRX, with the main reported outflow valued at nearly $16 million. The exact attribution and circumstances of the transfers remain contested.

3. What explanation did CoinDCX provide?

CoinDCX said the addresses were associated with its July 2025 security incident and had been deprecated. The company later acknowledged that its process for sweeping deposits sent to those addresses failed for a period, resulting in operational losses that it said it had absorbed.

4. Are CoinDCX customer funds safe?

CoinDCX says customer funds remain safe and that affected deposits were credited to users. Investigators have questioned the handling of the affected addresses and deposits. The public reporting does not establish that all customers suffered losses, nor does it independently resolve every question about the exchange’s accounting.

5. What was CoinDCX’s July 2025 hack?

In July 2025, CoinDCX reported a security breach involving an internal liquidity account, with losses estimated at approximately $44 million. The exchange said the affected account was separate from customer custody infrastructure.

Looking Ahead

Further disclosures from CoinDCX and additional blockchain analysis will be important in determining how the October transfers occurred and how the affected deposits were accounted for. The most significant questions concern the continued activity associated with the disputed addresses, the failure of the sweeping process and the relationship between the reported outflows and the exchange’s current wallet infrastructure.

For cryptocurrency users, the episode is a reminder to verify deposit details carefully and to evaluate exchange security claims alongside available evidence. For the industry, it highlights the need for rigorous wallet lifecycle management, effective monitoring and transparent communication when suspicious transfers raise questions about customer assets.