CoinDCX denies second hack claims as ZachXBT questions wallet activity

Indian cryptocurrency exchange CoinDCX has denied allegations of a new security breach involving nearly $16 million in cryptocurrency transfers, although blockchain investigator ZachXBT has challenged the company’s explanation of the suspicious wallet activity.

CoinDCX said in an October 22 statement that claims circulating on X were misleading because the transactions involved wallet addresses created in January 2025 and compromised during its July 2025 security incident.

The exchange maintained that customer funds remained safe and that the addresses identified in the latest allegations were no longer part of its active wallet infrastructure.

However, ZachXBT disputed the explanation, claiming that at least one of the addresses continued handling deposits and interacting with CoinDCX’s current hot wallets several months after the previous breach.

The disagreement followed allegations from blockchain investigator Darcy, who flagged transactions involving approximately 15.99 million USDT and 5,783.81 TRX on the TRON network.

CoinDCX disputes claims of another $16 million hack

According to Darcy, the suspicious transactions occurred on October 21 at approximately 23:35 UTC+8, when funds from wallets identified as CoinDCX deposit addresses and hot wallets moved to a separate TRON address.

The investigator identified a transfer of 15,819,002 USDT as the largest individual transaction and claimed that the receiving address subsequently distributed the funds across multiple wallets.

Darcy alleged that some of the funds eventually reached deposit addresses associated with Binance, OKX, Gate and other cryptocurrency exchanges after passing through several intermediary addresses.

However, the investigator’s findings did not independently establish whether the transfers were unauthorized or whether the receiving wallets belonged to an attacker.

Responding to the allegations, CoinDCX co-founder and CEO Sumit Gupta rejected suggestions that the exchange had suffered another breach.

“CoinDCX wallets are not breached,” Gupta wrote, urging users not to spread rumors while the company examined the transactions.

Gupta explained that the addresses identified through Arkham Intelligence previously belonged to CoinDCX but had been compromised during the July 2025 attack.

According to the executive, the attackers appeared to be reusing those addresses, which he described as a possible false alarm.

He maintained that the exchange had checked its current operational and customer addresses and found no transfers from those wallets to the addresses involved in the allegations.

Gupta further pointed to CoinDCX’s publicly available proof of reserves information and said the company would provide additional details as its investigation continued.

ZachXBT challenges CoinDCX over continued wallet activity

ZachXBT subsequently questioned the exchange’s account, citing transactions involving a deposit address identified as TQKJQ on the TRON blockchain.

The investigator claimed that the address remained in use by a liquidity provider for approximately 10 months after the July 2025 incident, despite CoinDCX describing the associated wallets as compromised.

According to ZachXBT, the address continued receiving deposits and gas transfers as recently as April and May 2026, with funds moving to wallets publicly identified as CoinDCX’s current hot wallets.

He argued that the transaction history contradicted the company’s explanation that the addresses were simply abandoned wallets being reused by attackers.

ZachXBT further alleged that approximately $15.8 million in customer deposits had gone unaccounted for by the exchange.

The screenshot accompanying his post showed a transfer of roughly 15.819 million USDT on October 21, alongside several smaller transactions involving USDT and TRX during May 2026.

However, the available screenshots do not independently establish ownership of every wallet, the purpose of the transactions, or whether the reported amount represents a confirmed customer loss.

CoinDCX had not publicly reconciled the specific transaction history cited by ZachXBT with its explanation at the time of reporting.

CoinDCX previously suffered a $44 million security breach

The dispute follows CoinDCX’s July 2025 security breach, when attackers stole approximately $44 million from an internal liquidity account used by the exchange.

As crypto.news previously reported, the company attributed the incident to a sophisticated server compromise and maintained that customer assets held separately in cold storage were unaffected.

CoinDCX initially suspended certain services as a precaution but subsequently restored normal operations while investigating the incident with security specialists and Indian authorities.

The company said it would absorb the losses through its treasury and later announced a recovery bounty program offering up to 25% of recovered assets, capped at $11 million.

The exchange had previously established a customer protection fund in August 2024, initially allocating approximately $6 million and committing 2% of its brokerage income toward the fund.

The initiative followed the $230 million WazirX hack, which affected customer assets and prompted questions about how Indian cryptocurrency exchanges would handle losses arising from security incidents.

During the July 2025 breach, CoinDCX maintained that its internal operational wallets were separate from customer custody infrastructure, allowing the company to cover the stolen assets without passing the losses on to users.

In his latest response, Gupta said the team was continuing to investigate the disputed transactions and would release further information through CoinDCX’s official communication channels.