An on-chain investigator flagged $16 million in USDT leaving CoinDCX-linked addresses on 21 October. Co-founder Sumit Gupta says no funds were compromised and the wallets were lost in the July 2025 breach.
Crypto exchange security breach incidents remain a persistent concern in the industry. CertiK counted $1.32 billion lost to security incidents in the first half of 2026 alone, and the biggest Indian exchange breaches, WazirX in 2024 and CoinDCX in 2025, both began with quiet transfers out of hot wallets that nobody could explain for hours.
So when roughly $16 million in USDT left CoinDCX-linked addresses on 21 October, the market assumed the worst. The exchange, however, claimed there was no cause for alarm.
The alert came from Darcy, an on-chain investigator who co-founded the asset recovery service Flash Rescue. By his count, about 15.99 million USDT and 5,784 TRX moved from CoinDCX hot wallet and deposit addresses to one TRON address, TAg6…g5bT, across 44 transfers. The largest single transfer, 15.82 million USDT, left an address labelled "CoinDCX Deposit Address" by Arkham at 11:35 am ET on 21 October.
From there, the funds were split, with separate payments of 2 million and 3 million USDT, and routed through intermediate wallets toward deposit addresses at Binance, OKX and Gate. That pattern, consolidate then scatter toward exchange deposits, is what laundering usually looks like. It is also what a hacker cashing out old loot looks like: that is the explanation the exchange is going by.
Co-founder Sumit Gupta responded on X on 22 October. He wrote,
"None of the CoinDCX funds got compromised."
The flagged addresses, he said, belonged to CoinDCX before the July 2025 breach and were compromised at that time. The exchange checked its current central and user addresses and found none had sent funds to the flagged wallets. He suggested the attackers were reusing old addresses and said further detail would follow through official channels.
If Gupta’s account is accurate, the 21 Oct. transfers represent the movement of stolen funds that had sat still for fifteen months associated with the July 2025 attack, rather than evidence of a new breach. The Arkham label may thus be outdated rather than wrong: the address was CoinDCX's once, and the label never caught up.
The exchange lost about $44 million in July 2025 through what it described as a server breach affecting an internal liquidity account on a partner exchange. User funds were not touched in that incident, CoinDCX said at the time.
While the transfers are publicly visible, they do not show who controlled the sending addresses on 21 October. Nor do they indicate whether CoinDCX's live operations were involved. Gupta's account answers that question, but the on-chain data alone does not.
That said, two things would settle it. The first is a reconciliation statement from CoinDCX showing current hot wallet balances against the addresses it operates today. The second is whether Binance, OKX, and Gate freeze the deposits, which exchanges do when a counterparty flags stolen funds and tend not to do when nobody files a claim.
Until further clarifying statements or evidence to support either position emerges, the existing scenario portrays that $16 million tied to past CoinDCX-linked addresses were moved, and the exchange claims its present funds were untouched. For a company that has already written one $44 million cheque, the distinction matters.
No comments yet
