India's largest exchange denies hack after sleuths pointed to $16 million in suspicious outflows
Markets
India's largest exchange denies hack after sleuths pointed to $16 million in suspicious outflows
CoinDCX denies its active wallets were hacked after sleuths flagged $16 million in outflows from addresses linked to the India-based exchange.
By Omkar Godbole|Edited by Jamie Crawley
Updated Oct 23, 2026, 4:04 a.m. EDTPublished Oct 23, 2026, 4:02 a.m. EDT
3 min readMake preferred on ShareShare this article
Copy linkX iconX (Twitter)LinkedInFacebookEmail
Make preferred on
CoinDCX denies hack after blockchain analysts flag suspicious flows. (Naveed Ahmed/Unsplash)
Summary
Show
CoinDCX denied that its active wallets were compromised after blockchain investigators flagged about $16 million in suspicious outflows from addresses linked to the Indian crypto exchange.
The exchange said the transactions involved addresses compromised in a July 2025 hack, but an investigator said at least one continued to receive deposits and interact with CoinDCX’s current wallet into 2026.
CoinDCX acknowledged that a temporary failure in its process for moving deposits from retired addresses caused operational losses, which it absorbed after crediting affected users.
India's largest crypto exchange, CoinDCX, has denied that its active wallets were compromised, after blockchain sleuths flagged about $16 million in suspicious outflows from wallets linked to the exchange.
“The transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since. The activity now being reported relates to these old addresses and does not have any connection with CoinDCX,” the exchange’s spokesperson told CoinDesk. “Current CoinDCX central and user addresses have not been impacted, and no CoinDCX funds from active wallets have been compromised.”
It started when an X user named Darcy highlighted a large outflow from CoinDCX's hot wallet and several of its deposit addresses on Wednesday. It totaled about $16 million in USDT, a dollar-pegged stablecoin, and Tron’x TRX token.
Every user gets a personal deposit address, a unique string of characters to send crypto to. The exchange then regularly "sweeps" those deposits, meaning it moves them into its own main wallets so everything sits in one place it controls. Some of that money goes to a hot wallet, an internet-connected place used for everyday withdrawals. The rest goes to cold wallets, which are kept offline.
All of it was sent to a single Tron address, Darcy said, with the largest transaction at 15,819,002 USDT. That address then split the money across several different wallets.
Darcy's post flagged the outflow as a suspected theft, raising fears of a fresh hack at the exchange. CoinDCX was exploited before, in July 2025, for about $44 million.
CoinDCX’s CEO Sumit Gupta pushed back on X, saying the July 2025 hackers seem to be reusing the old wallet addresses and calling it a false alarm.
In other words, CoinDCX’s position is that the exchange abandoned those addresses after the hack and that the hackers are the ones still using them.
ZachXBT, a well-known on-chain investigator, challenged that claim. He said at least one of those addresses, labeled TQKJQ was still in use.
Newsletters
Crypto Daybook Americas - The latest moves in crypto markets, in context
Market analysis for crypto traders and investors.
Preview
Sign up
By signing up, you will receive emails about CoinDesk products and you agree to our terms & conditions and privacy policy.
"CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet,” he said.
In plain terms, he said the address kept collecting customer deposits and passing them into CoinDCX's current wallet this spring. An LP is a liquidity provider, a firm that supplies buy and sell orders to an exchange. Gas is the small fee paid to move tokens on a blockchain.
When asked whether that old address wasn’t abandoned and was still handling money, CoinDesk said that it did tell its users following the July 2025 hack not to deposit funds to such compromised addresses. The exchange now calls these addresses "deprecated," or retired.
"Despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones," the spokesperson said.
The exchange said sweeping is meant to catch such deposits, but that it failed for a period. CoinDCX said it credited every affected user. It said customer assets sit in cold wallets and that its current addresses were not hit. Trading continues as usual.
India
Latest Crypto News
1Franklin Templeton adds $150 million in fund shares to XRP Ledger, all in one wallet3 hours ago
2Robinhood sees surge in bitcoin, gold prediction markets as traders move beyond sports18 hours ago
3Bitcoin Core changes security rules as AI makes finding code bugs dangerously easy20 hours ago
4Bitcoin's price is as jumpy as Nvidia's and eight times more turbulent than the euro20 hours ago
5Live updates: Bitcoin holds above $81,000 as oil prices hit six-month high20 hours ago
6Bitcoin steadies near $81,700 as altcoins rebound, pepe climbs 13%21 hours ago
7Bitcoin appears to have decoupled from midterm cycle bottom history 21 hours ago
8HSBC rolls out its first stablecoin to over 3 million everyday app users21 hours ago
9Sweden’s central bank revives e-krona debate as stablecoins and digital euro loom23 hours ago
10Polymarket has reportedly fired its marketing chief, also a close friend of the CEO1 day ago
Latest Research
Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins
Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
By CoinDesk Research
Sep 24, 2026
Commissioned byRealFi
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Why it matters:
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
View Full Report
More From Markets
Franklin Templeton adds $150 million in fund shares to XRP Ledger, all in one wallet
Robinhood sees surge in bitcoin, gold prediction markets as traders move beyond sports
Live updates: Bitcoin holds above $81,000 as oil prices hit six-month high
