The CoinDCX hack concerns resurfaced on October 22, 2026, after blockchain investigator Darcy flagged approximately $16 million in cryptocurrency transfers from wallets associated with the Indian exchange. However, co-founder Sumit Gupta denied a new security breach, saying the flagged addresses were compromised during the July 2025 incident and did not belong to the exchange’s current operations.
The reported transfers included approximately 15.99 million USDT and 5,783.81 TRX, according to Darcy’s post on X. The largest transaction involved around 15.82 million USDT, which moved to a single address on the TRON network before being divided among multiple wallets.
Also Read | Tesla Q3 2026 Earnings Show 43% Profit Drop Despite Higher Margins
CoinDCX Hack Alert Follows Large USDT Transfers
Chief Marketing Officer Darcy of Salus security firm sounded the alarm on October 22 after spotting odd transactions made from addresses linked to CoinDCX hack. The transactions allegedly took place towards the end of October 21, and the funds were moved to the deposit addresses of Binance, OKX, Gate, and others.
The transfers prompted scrutiny after blockchain analytics platform Arkham labelled the addresses as wallets associated with CoinDCX. However, determining the identity of an address via labels does not mean that the exchange continues to control it or that it sanctioned the recent transactions on the address.
The reported transfers alone did not confirm a new hack. CoinDCX’s response shifted the focus from the transaction amounts to the history and ownership of the wallets involved.
Sumit Gupta Says Flagged Wallets Were Compromised
Gupta commented on Darcy’s post shortly after it appeared and rejected the idea that there had been any breach at CoinDCX. According to the post, those addresses were created in January 2025 and were compromised during the attack that took place in July 2025.
As Sumit Gupta states, the exchange reviewed its central and user addresses, but none of them have transferred the funds to those flagged wallets. Furthermore, he refers to the CoinDCX public page that provides users with details concerning the reserves of the exchange.
CoinDCX itself also stated that their customers’ funds are still safe and trading operations are continuing as usual. The above is the company’s version of what happened; no additional independent verification of wallet history and recent transactions is provided in the materials.
CoinDCX Hack Alert Triggered After Loss of $44 Million
The latest report follows CoinDCX’s major security incident in July 2025, when attackers compromised an internal operational account used for liquidity provisioning on a partner exchange. The company had revealed the compromise of around $44 million, which it claimed was contained with the isolation of the account.
According to the company’s official incident report, the security breach did not affect any of the customer funds, which continued to remain safe in cold wallets. CoinDCX assured that no loss would be charged to the customers and instead would be paid out from its treasury fund.
Furthermore, it mentioned the measures undertaken to trace the transactions, along with coordination with the partners in the ecosystem. The difference between the internal liquidity account and customer wallet is significant to understand the CoinDCX hack alert.
CoinDCX Security Claims Focus on Current Wallets
The case highlights a challenge in blockchain investigations: wallet labels can preserve historical associations even after an address has been compromised or abandoned by its original owner. Investigators can trace public transactions, but additional evidence is needed to establish who controlled an address when funds moved and whether a transfer was unauthorized.
Transfers to exchange deposit addresses can provide investigators with leads for tracing assets. However, such movements do not establish that the receiving platforms were involved in a breach or identify the people who controlled the funds.
For users, the issue of whether current wallets and balances of the exchange are compromised is of primary importance. CoinDCX has stated that their current addresses have not been compromised, while their reserve addresses provide additional verification of their claims.
Also Read | Injective Announces Second Stockdrop as INJ Price Eyes Bullish Reversal
This article contains market analysis and price predictions. These are not guarantees. Crypto markets are volatile. Always DYOR. Not financial advice.
Be the first to comment