Suspicious transactions from a wallet long linked to Indian crypto exchange CoinCDX have set off a fresh theft investigation, after on-chain data showed more than $15 million in stablecoins moving out of an address that was exposed in the exchange's July 2025 breach.

The outflows were detected late on October 21, totaling $15.99 million in USDT and 5,783.81 TRX. The funds were routed to an intermediary address, which was then emptied out, with part of the USDT reaching Binance hot wallets as well as OKX and Gate.

CoinCDX denies that the wallet is currently under its control, claiming the address was falsely flagged on Arkham Intelligence.

"The addresses tagged by Arkham used to belong to CoinDCX before the last year hack ie July 2025. These addresses were generated in Jan 2025 and were compromised in the previous hack in July 2025. The hackers seem to be re-using the old wallet addresses and this sounds like a false alarm," the exchange's co-founder Sumit Gupta explained on X.

CoinCDX wallet was still used in DeFi protocols

While CoinCDX says it neither used nor controlled the wallet, on-chain evidence shows the address remained active long after the 2025 exploit. On-chain researcher ZachXBT noted that the wallet has still been used as a liquidity provider, while also sweeping user deposits. He additionally flagged that CoinCDX has yet to account for around $15.8 million in user funds in a transparent proof of reserves — the disclosure through which exchanges let users verify that holdings cover customer liabilities.

Rather than representing another wallet theft, the recent movement of funds may instead show that CoinCDX users kept depositing to the wallet for at least 10 months after the 2025 hack. ZachXBT also discovered that the exchange's current hot wallets were still sending gas to the compromised address as late as April 2026.

The episode adds to a troubled record. As Cryptopolitan previously reported, CoinCDX has been flagged as an exchange used in fraud laundering, and in 2025 it also suffered a hack that took up to $44 million.

CoinCDX is a relatively small exchange, recording $1.15 million in daily volume over the past 24 hours according to CoinGecko. Its most active pair is between fiat and USDT, with a limited number of assets offered. The platform is already seen as inherently risky, but the latest findings have deepened doubts that the market operator may have failed to protect user funds, allowing deposits to refill an already compromised wallet.

Can the CoinCDX funds be salvaged?

In an unusual move, the funds taken from CoinCDX were moved to centralized exchanges. Most of the amount was held in USDT, meaning either Tether or the exchanges could freeze and revert the loss — but that depends on CoinCDX confirming that an exploit took place. Tether has frozen USDT in previous theft cases, so whether the issuer and the receiving platforms move to block the flagged funds is one of the main developments to watch as the investigation unfolds.

The fund movements from the exploiter wallet also repeated the pattern of the previous CoinCDX hack, in which stolen funds were laundered through centralized markets.

At present, CoinCDX is suspected of flawed security practices and of actually reusing its compromised wallets, while not providing sufficient proof of the safety of user funds. The exchange has once again issued a statement saying it did not interact with those wallets, going against the on-chain evidence.

The CoinCDX exposure is a relatively rare event, as most hacks target decentralized protocols. The suspected exploit arrives at a time when crypto users are becoming more wary of hacks and accidental exposure, including private keys compromised through the Railway breach and the potential effects of newly discovered PHP vulnerabilities.

The CoinCDX incident is still not fully understood. But if the exchange diverted user funds to a compromised address, it would further undermine trust in depositing crypto to exchange wallets.

On-chain research has found additional links between the hacker's wallets and addresses used by CoinCDX, as noted by @DarcyAri, the account that first noticed the suspicious transfers.