CoinDCX Said Those Wallets Died in Its 2025 Hack. Then $16M Walked Out of Them, and the 'Rumour' Became 'Operational Losses'

“Pls don’t spread rumours.” That was CoinDCX co-founder and CEO Sumit Gupta on Thursday, after an on-chain researcher flagged about $16 million in USDT leaving addresses tagged as CoinDCX’s.

The company said those wallets had been dead since its $44 million hack in July 2025.

By the end of the same day, CoinDCX was telling users that a deposit process had failed, that people had kept sending money to those “dead” addresses, and that it would absorb the “operational losses.” It didn’t say how big they were.

---

What Happened

On October 21, 2026, about 15.99 million USDT and 5,783.81 TRX moved from a CoinDCX-labeled hot wallet and several deposit addresses to a single TRON address. The biggest single transfer was 15,819,002 USDT. The funds were split across wallets and, after a few hops, landed at deposit addresses on Binance, OKX and Gate.

The transfers were flagged on October 22 by Darcy, whom ForkLog and CoinCodex identify as CMO at security firm Salus. Cointelegraph lists Darcy as co-founder of recovery platform FlashRescue. Arkham Intelligence labels the source addresses as CoinDCX’s.

Round One: “Users’ Funds Are Safe”

CoinDCX’s response came fast. ForkLog says it landed less than three hours after Darcy’s post:

• The company: “These addresses were compromised in July 2025 and have not been used by CoinDCX since.”
• Gupta: “Thanks for highlighting but this is incorrect and CoinDCX wallets are not breached. Pls don’t spread rumours.”
• Gupta again: the addresses “were generated in Jan 2025 and were compromised in the previous hack in July 2025.” His explanation was that the hackers seem to be re-using old addresses.

CoinDCX also said none of its current central or user addresses had sent money to the flagged ones.

Round Two: ZachXBT Shows Up

Then ZachXBT posted:

“CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident… Meaning $15.8M in user deposits was unaccounted for by your team.”

His screenshots show that address sweeping user deposits and receiving gas to CoinDCX’s current public hot wallet as recently as April and May 2026. In other words, the “abandoned since July 2025” wallet was still connected to the live exchange ten months later.

Gupta’s reply, per Cointelegraph: “Yes, aware of that. We’re investigating it further, and will share an update soon… We assure that no user funds will be at loss.”

ZachXBT wasn’t satisfied. Coinpedia quotes his advice: “Withdraw all funds from CoinDCX if you value your assets.” Security researcher Taylor Monahan said she was unsure whether the exchange was lying or “too incompetent to understand it,” per CoinCodex.

Round Three: The Update

Later on Thursday, CoinDCX changed its story. According to Cointelegraph, TokenPost and Coinpedia:

• Some users kept depositing to the addresses that were retired after the July 2025 incident.
• CoinDCX says it regularly sweeps deposits out of those addresses. That process failed for an unspecified period, and the company says it only noticed that morning.
• In CoinDCX’s words, per Cointelegraph: “This failure led to some operational losses, which were absorbed by CoinDCX.”
• It says affected deposits were credited to user accounts and its current wallets weren’t touched.

The size of those losses: not disclosed. CoinDCX hasn’t confirmed or disputed the ~$15.8M figure. As crypto.news notes, the on-chain data on its own doesn’t prove who owns every wallet, or that the full amount was a customer loss.

The July 2025 Backstory

This is the same exchange that lost about $44 million in July 2025 from an internal account used to provide liquidity on a partner exchange. ZachXBT reported that hack first. ForkLog says attackers had pulled the funds about 17 hours before management confirmed it. Cyvers linked the attack to North Korea’s Lazarus Group based on how the funds moved. Indian police later detained a CoinDCX employee whose work laptop the attackers had used. CoinDCX covered that loss from its treasury and offered a bounty of up to 25% of recovered funds.

So the addresses at the center of this week’s fight have been compromised for 15 months, and users were still depositing into them for at least ten of those months.

---

Why This Matters for Crypto Jobs

Retiring a wallet means more than one tweet. Deposit addresses don’t disappear when an exchange stops using them, because users keep pasting old addresses. Shutting one down properly means redirecting deposits, monitoring sweeps, alerting when a sweep fails, and, when the keys are already compromised, racing attackers to sweep every deposit out first. That is wallet-infrastructure and treasury-ops work, and it pays well because getting it wrong costs eight figures.

On-chain monitoring is the job now. Darcy, ZachXBT and Arkham found this before CoinDCX did. Exchanges that don’t run their own monitoring on every address they’ve ever published will keep learning about their losses from X. Security operations and blockchain forensics roles exist to close that gap.

Incident comms is a real discipline. Going from “pls don’t spread rumours” to “operational losses” in one day does more damage to trust than the loss itself. Exchanges need people who can handle disclosure, legal and security response together, and say only what they’ve confirmed.

India’s exchanges are under the microscope. After WazirX’s $230M hack and CoinDCX’s two incidents, compliance, risk and proof-of-reserves roles in the Indian market are going to keep getting harder to staff and easier to justify.

---

The Bottom Line

CoinDCX’s first answer was that the wallets were dead and the researchers were wrong. Its second answer was that the wallets were still taking deposits, a process broke, and it’s covering the bill. The one number everyone wants, how much it actually lost, is still missing.

Until CoinDCX gives that number, the on-chain sleuths are the only ones publishing figures.

---

Want to be the one who catches a failed sweep before ZachXBT does? Exchanges are hiring for wallet infrastructure, security ops and on-chain forensics. Browse open roles on Cryptogrind →