CoinDCX denies hack after $16m flagged from old wallet addresses

Key points

• An X user named Darcy flagged about $16m in USDT and TRX leaving CoinDCX's hot wallet and deposit addresses on Wednesday, with the largest transfer at $15,819,002.
• CoinDCX says the addresses were created in January 2025, compromised in July 2025 and retired since; CEO Sumit Gupta called the alarm false.
• Investigator ZachXBT said address TQKJQ kept taking deposits and passing them to CoinDCX's current hot wallet as recently as April and May 2026.

All of it went to a single Tron address, with the largest transaction at $15,819,002, before being split across several wallets. Darcy flagged the movement as a suspected theft, recalling the roughly $44m exploit CoinDCX suffered in July 2025.

CEO Sumit Gupta said on X that the July 2025 hackers appeared to be reusing the old addresses and called it a false alarm. On-chain investigator ZachXBT challenged that, saying the deposit address labelled TQKJQ was used by a liquidity provider for 10 months after the incident and swept user deposits into CoinDCX's current public hot wallet as recently as April and May 2026.

CoinDCX said it warned users after the July 2025 hack not to deposit to compromised addresses, now called deprecated, but some continued to do so. It said its process for sweeping such deposits into main wallets failed for a period, causing operational losses it absorbed after crediting every affected user. Customer assets sit in cold wallets and trading continues as usual, it said.

Read the full story on CoinDesk →