India's largest cryptocurrency exchange, CoinDCX, has denied suffering a new security breach after blockchain investigators identified approximately $16 million in suspicious cryptocurrency transfers. The company nonetheless later acknowledged operational losses tied to previously compromised wallet addresses, raising fresh questions about its security practices.

The controversy surfaced on October 21, 2026, when investigators detected significant movements of USDT and TRX tokens. CoinDCX maintains that its active wallets remain secure and that customers have not suffered financial losses.

Investigators Flag $16 Million in Transfers

Blockchain investigator Darcy identified suspicious transactions involving approximately 15.99 million USDT and 5,783 TRX on the Tron network. Because blockchains record every transfer on public ledgers, independent investigators can monitor and flag large fund movements without relying on an exchange's own disclosures. According to a CoinDesk report, the funds moved from addresses associated with CoinDCX into a single receiving wallet before spreading across multiple addresses.

The largest individual transaction involved approximately 15.82 million USDT. Investigators subsequently traced portions of the transferred funds to addresses linked to several major cryptocurrency exchanges.

The activity prompted concerns of another potential breach, coming more than a year after CoinDCX suffered a July 5 cyberattack that resulted in approximately $44 million in losses.

CoinDCX Rejects Hack Allegations but Confirms Losses

CoinDCX CEO Sumit Gupta rejected claims that hackers had compromised the exchange's current wallets, explaining that the suspicious transactions involved older addresses affected by the July 2025 security incident.

Blockchain investigator ZachXBT, however, challenged that explanation, claiming that at least one supposedly discontinued address continued processing deposits months after the previous attack. The dispute centers on whether addresses linked to the earlier breach were genuinely taken out of service.

CoinDCX subsequently acknowledged that some customers kept sending cryptocurrency to outdated deposit addresses despite warnings. The exchange normally moves such deposits into secure wallets through an automated process known as sweeping, a routine practice exchanges use to consolidate customer funds into more secure storage.

According to the company, that process failed temporarily, resulting in operational losses. CoinDCX said absorbed those losses and credited all affected customer deposits.

Security Questions Remain Despite Customer Assurances

CoinDCX maintains that customer assets remain protected in segregated cold wallets, a standard industry safeguard that keeps funds offline and insulated from online attacks. The company also confirmed that trading operations continue normally and that its active wallet infrastructure remains unaffected.

Nevertheless, investigators continue to question how previously compromised addresses remained involved in cryptocurrency transfers. The exchange has not publicly disclosed the exact financial impact of its operational failure. The key details to watch are whether CoinDCX quantifies those losses and explains how addresses tied to the July 2025 incident remained in use.

The episode underscores the importance of disciplined wallet management and transparent security disclosure across the cryptocurrency industry. For CoinDCX, restoring confidence will depend on explaining the disputed transactions and demonstrating that its safeguards can prevent similar incidents.