India's largest crypto exchange, CoinDCX, has denied that its active wallets were compromised, after blockchain investigators flagged roughly $16 million in suspicious outflows from addresses linked to the platform.

The exchange said the flagged transactions involved old wallet addresses that were compromised in a July 2025 hack and have not been used since. However, at least one on-chain investigator countered that one of those addresses continued to receive deposits and interact with CoinDCX's current wallet into 2026. That clash is what makes the episode more than a routine false alarm: everything turns on whether addresses the exchange calls retired were still wired into its live deposit flow — the difference between hackers reusing dead addresses and an operational lapse on the platform side.

CoinDCX acknowledged that a temporary failure in its process for sweeping deposits from retired addresses caused operational losses, which it absorbed after crediting affected users.

"The transactions mentioned in recent claims involve old wallet addresses created in January 2025. These addresses were compromised in July 2025 and have not been used by CoinDCX since. The activity now being reported relates to these old addresses and does not have any connection with CoinDCX," the exchange's spokesperson told CoinDesk. "Current CoinDCX central and user addresses have not been impacted, and no CoinDCX funds from active wallets have been compromised."

How the suspicions emerged

The concerns were raised on Wednesday, when an X user named Darcy highlighted a large outflow from CoinDCX's hot wallet and several of its deposit addresses. The transfers totaled about $16 million in USDT, a dollar-pegged stablecoin, and Tron's TRX token.

Every CoinDCX user receives a personal deposit address, a unique string of characters used to send crypto to the exchange. The platform regularly "sweeps" those deposits, meaning it moves them into its own main wallets so that everything sits in one place it controls. Some of that money goes to a hot wallet, an internet-connected wallet used for everyday withdrawals, while the rest is moved to cold wallets, which are kept offline. Sweeping is standard practice at centralized exchanges, which is why anomalies in that flow tend to be read as potential security events rather than routine housekeeping.

According to Darcy, all of the flagged funds were sent to a single Tron address, with the largest single transaction amounting to 15,819,002 USDT. That address then split the money across several different wallets. The post flagged the outflow as a suspected theft, raising fears of a fresh hack at the exchange.

CoinDCX was exploited before, in July 2025, losing about $44 million in that incident.

CEO calls it a false alarm; investigator pushes back

CoinDCX CEO Sumit Gupta pushed back on X, saying the hackers from July 2025 appear to be reusing the old wallet addresses and calling the episode a false alarm. In other words, the exchange's position is that it abandoned those addresses after the hack and that the hackers are the ones still using them.

ZachXBT, a well-known on-chain investigator, challenged that claim, saying at least one of those addresses, labeled TQKJQ, was still in use.

"CoinDCX deposit address TQKJQ was in use by a LP for 10 months after your July 2025 incident and swept user deposits + received gas as recent as April & May 2026 to your current public hot wallet," he said.

In plain terms, ZachXBT said the address kept collecting customer deposits and passing them into CoinDCX's current wallet as recently as this spring. An LP, or liquidity provider, is a firm that supplies buy and sell orders to an exchange, while gas is the small fee paid to move tokens on a blockchain. If borne out, that account blurs the clean line the exchange is drawing between retired and active infrastructure — the crux of the disagreement.

Exchange acknowledges cleanup lapse

Asked whether the old address had been left abandoned while still handling money, CoinDCX said it had warned users following the July 2025 hack not to deposit funds to compromised addresses. The exchange now refers to these addresses as "deprecated," or retired.

"Despite our notifications in the past, some users continued to deposit funds to deprecated deposit addresses instead of the latest ones," the spokesperson said.

The exchange said the sweeping process is meant to catch deposits sent to such addresses, but that it failed for a period. CoinDCX said it credited every affected user. It added that customer assets sit in cold wallets and that its current addresses were not hit. Trading continues as usual. The thread to watch is whether further on-chain documentation settles which account is right — and how CoinDCX explains why a deprecated address kept sweeping deposits long after the July 2025 incident. For depositors, the exchange's own statements carry the practical lesson: send funds only to the latest address a platform displays, because deposits to retired ones depend entirely on that cleanup process working.