--- title: "CoinDCX Faces Scrutiny From Sleuths Over $16M Transfer From Compromised Wallets" description: "On-chain researchers dispute the exchange's explanation after roughly 16 million $USDT was moved from addresses linked to a prior security breach." url: https://basisdesk.news/news/coindcx-disputed-analysts-16-million-wallet-transfer published: 2026-10-22T15:31:54.919Z modified: 2026-10-22T15:31:54.919Z section: Security & Hacks author: Basis Desk Newsroom (AI-generated, source-verified) sentiment: bearish tickers: [USDT, TRX] tags: [coindcx, security-breach, on-chain-investigation, tron, usdt, hacks] license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice. --- # CoinDCX Faces Scrutiny From Sleuths Over $16M Transfer From Compromised Wallets On-chain researchers dispute the exchange's explanation after roughly 16 million $USDT was moved from addresses linked to a prior security breach. ## At a glance - **What happened:** Investigators detected $16 million in unauthorized USDT and TRX transfers from CoinDCX deposit addresses on Oct. 22. - **Why it matters:** The incident reveals gaps in CoinDCX's wallet deprecation process following its July 2025 hack, drawing public accusations of misrepresentation. - **Who is affected:** CoinDCX and its depositors using legacy Tron deposit addresses. - **What's next:** No next step announced. - **Primary source:** [Crypto exchange CoinDCX ‘lying’ about $16M hack, say blockchain investigators](https://protos.com/crypto-exchange-coindcx-lying-about-16m-hack-say-blockchain-investigators/) — protos.com ## Key points - About $16 million in USDT and TRX left addresses linked to CoinDCX on Oct. 22 [1]. - CoinDCX claimed the funds represented failed sweep operations from wallets compromised in July 2025 [1]. - On-chain sleuths ZachXBT and Darcy disputed the claims, citing wallet activity continuing into May 2026 [1]. ## Editorial remark - **Context:** CoinDCX previously suffered a $44 million compromise in July 2025 after a developer laptop was breached via side-work activities [1]. The exchange claimed the newly flagged addresses were deprecated at that time [1]. - **Impact:** While CoinDCX confirmed that affected customer accounts remain credited, the incident exposes sweeping and internal accounting vulnerabilities regarding legacy infrastructure [1]. - **Watch:** Follow-up statements or formal audit disclosures from CoinDCX clarifying post-compromise key management and liquidity provider operations through early 2026 [1]. Cryptocurrency exchange CoinDCX has drawn criticism from on-chain security investigators following suspicious outflows totaling approximately $16 million from addresses tied to the platform [1]. The transactions involved transfers of roughly 15.99 million $USDT and 5,783.81 $TRX to an external Tron address, first flagged on Oct. 22 by Salus researcher Darcy [1]. CoinDCX co-founder Sumit Gupta initially dismissed the findings as an incorrect attribution, telling the researcher not to spread rumors [1]. The exchange subsequently published an official statement explaining that the movements originated from deposit addresses initially breached during its $44 million July 2025 hack [1]. CoinDCX stated that users had continued sending funds to the deprecated addresses despite warnings, requiring regular sweeping procedures that had temporarily failed [1]. The exchange acknowledged the unauthorized movements as "operational losses" while maintaining that affected user deposits remained credited [1]. ## Investigators Challenge Exchange Timeline Blockchain analysts swiftly questioned the company's timeline and explanations [1]. Darcy noted that the wallets received gas fee allocations both before and after the July 2025 compromise, with portions of the transferred funds routed toward laundering guarantee services such as Huione and Xinbi [1]. Independent researcher ZachXBT alleged that one of the flagged addresses was actively utilized by a liquidity provider for 10 months following the breach, routing assets to CoinDCX's operational hot wallet as late as May 2026 [1]. Other analysts pointed out procedural discrepancies in the fund movements [1]. Security specialist Taylor Monahan observed that the laundering patterns observed in the Oct. 22 incident diverged from the methods seen in CoinDCX's 2025 breach, suggesting different threat actors might be involved [1]. Researcher SpecterAnalyst characterized the outflows as standard theft dynamics, pointing to abrupt behavioral shifts from standard hot-wallet transfers toward OTC platforms and asset swaps [1]. At the time of writing, CoinDCX had not supplied further comment regarding how the capital sat unaccounted for prior to the outflows [1]. ## Sources 1. [Crypto exchange CoinDCX ‘lying’ about $16M hack, say blockchain investigators](https://protos.com/crypto-exchange-coindcx-lying-about-16m-hack-say-blockchain-investigators/) — protos.com, 2026-10-22 --- Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai