CoinDCX Faces Scrutiny From Sleuths Over $16M Transfer From Compromised Wallets
On-chain researchers dispute the exchange's explanation after roughly 16 million $USDT was moved from addresses linked to a prior security breach.
At a glance
- What happened
- Investigators detected $16 million in unauthorized USDT and TRX transfers from CoinDCX deposit addresses on Oct. 22.
- Why it matters
- The incident reveals gaps in CoinDCX's wallet deprecation process following its July 2025 hack, drawing public accusations of misrepresentation.
- Who is affected
- CoinDCX and its depositors using legacy Tron deposit addresses.
- What's next
- No next step announced.
- Primary source
- protos.com: Crypto exchange CoinDCX ‘lying’ about $16M hack, say blockchain investigators
Key points
Cryptocurrency exchange CoinDCX has drawn criticism from on-chain security investigators following suspicious outflows totaling approximately $16 million from addresses tied to the platform 1. The transactions involved transfers of roughly 15.99 million $USDT and 5,783.81 $TRX to an external Tron address, first flagged on Oct. 22 by Salus researcher Darcy 1.
CoinDCX co-founder Sumit Gupta initially dismissed the findings as an incorrect attribution, telling the researcher not to spread rumors 1. The exchange subsequently published an official statement explaining that the movements originated from deposit addresses initially breached during its $44 million July 2025 hack 1. CoinDCX stated that users had continued sending funds to the deprecated addresses despite warnings, requiring regular sweeping procedures that had temporarily failed 1. The exchange acknowledged the unauthorized movements as "operational losses" while maintaining that affected user deposits remained credited 1.
Investigators Challenge Exchange Timeline
Blockchain analysts swiftly questioned the company's timeline and explanations 1. Darcy noted that the wallets received gas fee allocations both before and after the July 2025 compromise, with portions of the transferred funds routed toward laundering guarantee services such as Huione and Xinbi 1. Independent researcher ZachXBT alleged that one of the flagged addresses was actively utilized by a liquidity provider for 10 months following the breach, routing assets to CoinDCX's operational hot wallet as late as May 2026 1.
Other analysts pointed out procedural discrepancies in the fund movements 1. Security specialist Taylor Monahan observed that the laundering patterns observed in the Oct. 22 incident diverged from the methods seen in CoinDCX's 2025 breach, suggesting different threat actors might be involved 1. Researcher SpecterAnalyst characterized the outflows as standard theft dynamics, pointing to abrupt behavioral shifts from standard hot-wallet transfers toward OTC platforms and asset swaps 1. At the time of writing, CoinDCX had not supplied further comment regarding how the capital sat unaccounted for prior to the outflows 1.
Sources
- [1] Crypto exchange CoinDCX ‘lying’ about $16M hack, say blockchain investigators — protos.com, October 22, 2026
Written by Basis Desk's newsroom system from the primary sources above and machine-verified against them before publication. Market figures marked "at the time of writing" come from live exchange data. Report an error: corrections@basisdesk.news · corrections policy.
The Daily Brief, in your inbox at 07:00 ET
Five stories, the numbers that moved, what to watch. Three minutes. No hype, no advice, unsubscribe in one click.
Get the big crypto stories first
A few alerts a day at most: major breaking news and the morning brief. Switch off anytime.
Not financial advice. Basis Desk publishes information, not recommendations. Crypto assets are volatile and you can lose what you invest.